mcp
2 live · 202 on record · last incident 4 days ago
Live2
- liveMCP SDKs MCP Tool Poisoning in Agentic AI Frameworks Across Multiple Frameworks
Research · since 3 Nov 2026 · updated 5 Nov 2026
Researchers present the first cross-framework measurement of Model Context Protocol (MCP) tool poisoning with real tool execution. Using an open-source tool called mcpvenom, the study demonstrates how untrusted tool descriptions and response data compromise agentic frameworks.
AI - liveMCP servers & tools AI coding agents install unpatched archived MCP servers
Research · since 3 Nov 2026
Research shows AI coding agents select deprecated and unpatched Model Context Protocol servers from archived repositories during user sessions. This creates ongoing supply chain exposure on developer machines.
AI
Earlier200
- closed6.5MCP servers & tools CVE-2026-125321: pgEdge Postgres MCP Server rate‑limit bypass via X‑Forwarded‑For
Patch now · Disclosed · Patched · since 10 Nov 2026 · CVE-2026-125321
AI - closed5.3MCP servers & tools CVE-2026-125320: pgEdge Postgres MCP Server vulnerable to DNS rebinding via Origin header
Patch now · Disclosed · Patched · since 10 Nov 2026 · CVE-2026-125320
AI - closed6.5MCP servers & tools CVE-2026-125322: pgEdge Postgres MCP Server allows subquery inference via count_rows tool
Patch now · Disclosed · Patched · since 10 Nov 2026 · CVE-2026-125322
AI - closed6.4fast-agent CVE-2026-102610: fast-agent Unauthenticated RCE Vulnerability
Patch now · Disclosed · Patched · since 6 Nov 2026 · CVE-2026-102610
AI - closed7.7MCP SDKs CVE-2026-111770: Model Context Protocol TypeScript SDK Multi-Client Message Routing Flaw
Research · Disclosed · since 5 Nov 2026 · CVE-2026-111770
AI - closed7.5MCP servers & tools CVE-2026-62264: PDF Reader MCP Authentication Bypass Flaw
Patch now · Disclosed · Patched · since 30 Oct 2026 · CVE-2026-62264
AI - closedMCP SDKs Log-To-Leak: Prompt injection attacks on tool-using LLM agents via MCP
Research · since 28 Oct 2026
AI - closed6.8MCP SDKs CVE-2026-116684: Model Context Protocol Python SDK resource-confusion authentication flaw
Patch now · Disclosed · Patched · since 27 Oct 2026 · CVE-2026-116684
AI - closed6.5MCP SDKs CVE-2026-116686: Model Context Protocol Python SDK SSRF and local file read via schema resolution
Patch now · Disclosed · Patched · since 27 Oct 2026 · CVE-2026-116686
AI - closed5.9MCP SDKs CVE-2026-116685: Model Context Protocol Python SDK credential leakage via redirects
Patch now · Disclosed · Patched · since 27 Oct 2026 · CVE-2026-116685
AI - closed7.5MCP SDKs MCP TypeScript SDK lacks request body size and batch length limits
Patch now · Disclosed · since 27 Oct 2026
AI - closedMCP SDKs Cross-modal steganographic prompt injection targeting Model Context Protocol agents
Research · since 26 Oct 2026
AI - closedFastMCP GHSA-7xgj-8392-5q4r: FastMCP post-transform component authorization bypass
Patch now · Disclosed · since 23 Oct 2026
AI - closedFastMCP GHSA-vqqp-x5qm-5qp4: FastMCP OAuth client provider issuer binding vulnerability
Patch now · Disclosed · since 23 Oct 2026
AI - closed5.9MCP servers & tools CVE-2026-57207: NetBox MCP Server lacks HTTP endpoint authentication
Patch now · Disclosed · since 23 Oct 2026 · CVE-2026-57207
AI - closed7.1obsidian-tc CVE-2026-115478: obsidian-tc MCP server suffers from path materialization flaw
Patch now · Disclosed · since 23 Oct 2026 · CVE-2026-115478
AI - closed7.1obsidian-tc CVE-2026-115477: obsidian-tc MCP server bypasses user confirmation check
Patch now · Disclosed · since 23 Oct 2026 · CVE-2026-115477
AI - closedOpenCode OpenCode Flaw Allows Malicious MCP Servers to Execute Code
Patch now · Disclosed · since Sep 2026 (approx.)
AI - closed7.5MCP servers & tools CVE-2026-114123: D365 F&O MCP Server authentication bypass vulnerability
Patch now · Disclosed · since 21 Oct 2026 · CVE-2026-114123
AI - closed7.5MCP SDKs CVE-2026-111768: MCP TypeScript SDK suffered from request validation memory exhaustion
Patch now · Disclosed · since 20 Oct 2026 · updated 5 Nov 2026 · CVE-2026-111768
AI - closed6.8MCP SDKs CVE-2026-111771: MCP TypeScript SDK accepted bearer tokens issued for other services
Patch now · Disclosed · since 20 Oct 2026 · updated 5 Nov 2026 · CVE-2026-111771
AI - closed6.5MCP SDKs CVE-2026-111769: MCP TypeScript client SDK leaked custom headers on cross-origin redirects
Patch now · Disclosed · since 20 Oct 2026 · updated 5 Nov 2026 · CVE-2026-111769
AI - closed8.6MCP SDKs CVE-2026-111767: MCP TypeScript SDK experimental tasks lacked session isolation
Patch now · Disclosed · since 20 Oct 2026 · CVE-2026-111767
AI - closed9.2Claude Code + SDKs CVE-2026-96620: Claude Agent SDK Command Injection Vulnerability
Patch now · Disclosed · since 16 Oct 2026 · CVE-2026-96620
AI - closed7.5MCP SDKs Model Context Protocol Python SDK Unbounded Session Accumulation Flaw
Patch now · Disclosed · since 14 Oct 2026 · updated 15 Oct 2026 · CVE-2026-59951
AI - closed7.5MCP SDKs Model Context Protocol Java SDK Unbounded Request Body Vulnerability
Patch now · Disclosed · since 14 Oct 2026 · CVE-2026-108395
AI - closed7.5MCP SDKs Model Context Protocol Python SDK Unbounded HTTP Body Memory Buffer Vulnerability
Patch now · Disclosed · since 14 Oct 2026 · CVE-2026-109527
AI - closed4.7obsidian-tc CVE-2026-77361: obsidian-tc MCP server symlink path traversal vulnerability
Patch now · Disclosed · since 13 Oct 2026 · CVE-2026-77361
AI - closed4.3obsidian-tc CVE-2026-77362: obsidian-tc MCP server access control bypass vulnerability
Patch now · Disclosed · since 13 Oct 2026 · CVE-2026-77362
AI - closed9.6obsidian-tc CVE-2026-77363: DNS-rebinding vulnerability in obsidian-tc MCP server
Patch now · Disclosed · since 12 Oct 2026 · CVE-2026-77363
AI - closed6.5obsidian-tc CVE-2026-77364: Information disclosure vulnerability in obsidian-tc MCP server
Patch now · Disclosed · since 12 Oct 2026 · CVE-2026-77364
AI - closed9.9obsidian-tc CVE-2026-77366: Access control flaw in obsidian-tc Model Context Protocol server
Patch now · Disclosed · since 12 Oct 2026 · CVE-2026-77366
AI - closed9.3MCP servers & tools x64dbg-MCP Server exposes unauthenticated debugging tools over HTTP
Patch now · Disclosed · since 9 Oct 2026 · CVE-2026-107824
AI - closed5.3MCP servers & tools x64dbg-MCP Server integer overflow leads to process crash
Patch now · Disclosed · since 9 Oct 2026 · CVE-2026-107820
AI - closed7.5MCP SDKs MCP TypeScript SDK OAuth Client Credential Exposure Vulnerability
Patch now · Disclosed · since 6 Oct 2026 · CVE-2026-104850
AI - closed7.1Langflow CVE-2026-105699: Langflow Authenticated Cross-Project File Disclosure
Patch now · Disclosed · since 5 Oct 2026 · updated 7 Oct 2026 · CVE-2026-105699
AI - closed9.9Langflow Langflow Remote Code Execution via MCP Stdio Transport
Patch now · Exploited · since 5 Oct 2026 · updated 15 Oct 2026 · CVE-2026-105740
AI - closed8.6OpenClaw CVE-2026-100585: OpenClaw bypasses owner-only authorization for Claude Code prompts
Patch now · Disclosed · since 26 Sep 2026 · CVE-2026-100585
AI - closed5.4MCP servers & tools CVE-2026-77272: Cross-site scripting in MCP Atlassian OAuth setup
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77272
AI - closed7.7MCP servers & tools CVE-2026-77258: Arbitrary file upload flaw in MCP Atlassian
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77258
AI - closed7.1MCP servers & tools CVE-2026-77261: SSRF vulnerability in MCP Atlassian server
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77261
AI - closed8.3MCP servers & tools CVE-2026-77271: Arbitrary file write and code execution in MCP Atlassian
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77271
AI - closed8.8MCP servers & tools CVE-2026-77274: Backslash authority confusion SSRF in MCP Atlassian
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77274
AI - closed8.3MCP servers & tools CVE-2026-77267: Header-based SSRF vulnerability in MCP Atlassian server
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77267
AI - closed6.1MCP servers & tools CVE-2026-77250: Insecure plaintext token storage in MCP Atlassian server
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77250
AI - closed7.5MCP servers & tools CVE-2026-77242: DNS rebinding vulnerability in MCP Atlassian server
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77242
AI - closed6.5MCP servers & tools CVE-2026-77252: Access control restriction bypass in MCP Atlassian filter inputs
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77252
AI - closed7.1MCP servers & tools CVE-2026-77253: Filesystem boundary traversal in MCP Atlassian attachment upload
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77253
AI - closed9.1MCP servers & tools CVE-2026-77254: Authentication boundary bypass in MCP Atlassian HTTP endpoint
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77254
AI - closed5.3MCP servers & tools CVE-2026-77249: SSRF vulnerability in MCP Atlassian server user lookup
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77249
AI - closed6.5MCP servers & tools CVE-2026-77270: Arbitrary file disclosure vulnerability in MCP Atlassian server
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77270
AI - closed6.5MCP servers & tools CVE-2026-77269: MCP Atlassian incomplete patch allows source path traversal
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77269
AI - closed8.3MCP servers & tools CVE-2026-77257: MCP Atlassian remote local file read and upload vulnerability
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77257
AI - closed8.3MCP servers & tools CVE-2026-77251: MCP Atlassian access control bypass in search and board APIs
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77251
AI - closed7.7MCP servers & tools CVE-2026-77259: MCP Atlassian local file disclosure via attachment upload
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77259
AI - closed7.4MCP servers & tools CVE-2026-77246: MCP Atlassian allows unauthorized transport and request manipulation
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77246
AI - closed8.3MCP servers & tools CVE-2026-77260: MCP Atlassian accepts unconstrained file paths in upload handler
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77260
AI - closed6.5MCP servers & tools CVE-2026-77266: MCP Atlassian allows absolute paths and traversal during upload
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77266
AI - closed8.6MCP servers & tools CVE-2026-77262: MCP Atlassian suffers from path traversal in file uploads
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77262
AI - closed8.8MCP servers & tools CVE-2026-77243: MCP Atlassian fails to recheck tool restrictions on dispatch
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77243
AI - closed8.3MCP servers & tools CVE-2026-77256: MCP Atlassian stores plaintext OAuth tokens insecurely
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77256
AI - closed8.6MCP servers & tools CVE-2026-77248: Unauthenticated file read and exfiltration in MCP Atlassian
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77248
AI - closed10.0MCP servers & tools CVE-2026-77244: Unauthenticated HTTP access in MCP Atlassian server
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77244
AI - closed8.3MCP servers & tools CVE-2026-77247: Arbitrary file upload vulnerability in MCP Atlassian server
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77247
AI - closed5.9MCP servers & tools CVE-2026-77265: DNS rebinding SSRF vulnerability in MCP Atlassian server
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77265
AI - closed5.5MCP servers & tools CVE-2026-77268: Insecure file permissions in MCP Atlassian server
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77268
AI - closed8.6MCP servers & tools CVE-2026-77255: MCP Atlassian Arbitrary File Read and Exfiltration Vulnerability
Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77255
AI - closed8.8MCP servers & tools CVE-2026-58197: Network isolation flaw in ToolHive MCP server management
Patch now · Disclosed · since 18 Sep 2026 · CVE-2026-58197
AI - closed7.5MCP servers & tools CVE-2026-50125: Unauthenticated endpoint vulnerability in MKP MCP server
Patch now · Disclosed · since 17 Sep 2026 · CVE-2026-50125
AI - closed7.5MCP SDKs CVE-2026-63128: RMCP Streamable HTTP server session leak
Patch now · Disclosed · since 16 Sep 2026 · CVE-2026-63128
AI - closed8.2MCP SDKs CVE-2026-63127: RMCP OAuth metadata validation flaw
Patch now · Disclosed · since 16 Sep 2026 · CVE-2026-63127
AI - closed6.8MCP SDKs RMCP Rust SDK Leaks Custom Headers on Cross-Origin Redirects
Patch now · Disclosed · since 16 Sep 2026 · CVE-2026-64684
AI - closed9.0Flowise Flowise Validation Bypass Vulnerability in MCP Server Configuration
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-91932
AI - closed9.0Flowise CVE-2026-91931: Flowise custom MCP node remote code execution
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-91931
AI - closed8.7Lokka CVE-2026-58201: Lokka Microsoft 365 MCP server bearer token leak
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-58201
AI - closed9.6MCP servers & tools CVE-2026-61568: @zereight/mcp-gitlab lacks host allowlist protection
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-61568
AI - closed7.5MCP servers & tools CVE-2026-58483: mcp-searxng memory exhaustion vulnerability
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-58483
AI - closed10.0MCP servers & tools CVE-2026-59971: MySQL MCP Server lacks authentication and DNS protection
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-59971
AI - closed7.1MCP servers & tools CVE-2026-58485: mcp-searxng susceptible to server-side request forgery
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-58485
AI - closed7.4MCP servers & tools CVE-2026-54547: Meta Ads MCP has HTTP authentication bypass flaw
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-54547
AI - closed6.9MCP servers & tools CVE-2026-57441: MCPVault contains path filter bypass vulnerability
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-57441
AI - closed8.5MCP servers & tools CVE-2026-59973: FrontMCP vulnerable to SSRF in OpenAPI spec loading
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-59973
AI - closed9.6MCP servers & tools CVE-2026-61559: Dynamic API URL redirection flaw in mcp-gitlab
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-61559
AI - closed6.9MCP servers & tools CVE-2026-57442: Path restriction bypass vulnerability in MCPVault
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-57442
AI - closed6.3MCP servers & tools CVE-2026-54689: URL policy bypass vulnerability in mcp-searxng
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-54689
AI - closed9.8MCP servers & tools CVE-2026-61560: Authentication bypass and arbitrary file read in mcp-gitlab
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-61560
AI - closed6.5MCP servers & tools CVE-2026-54688: SSRF vulnerability in mcp-searxng MCP server
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-54688
AI - closed8.3MCP servers & tools CVE-2026-54549: Meta Ads MCP Unvalidated Image URL Vulnerability
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-54549
AI - closed2.9MCP servers & tools CVE-2026-54450: ToolHive NAT64 IP Validation Vulnerability
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-54450
AI - closed4.7MCP servers & tools CVE-2026-58196: ToolHive Authentication Discovery Vulnerability
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-58196
AI - closed7.7MCP servers & tools CVE-2026-53957: Contentful MCP Server Unsafe Network Options Vulnerability
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-53957
AI - closed4.2Langflow CVE-2026-12763: Improper cache key isolation vulnerability in Langflow MCP Tools
Patch now · Disclosed · since 14 Sep 2026 · CVE-2026-12763
AI - closed7.7MCP servers & tools CVE-2026-73496: MCP Atlassian vulnerable to arbitrary file upload and path traversal
Patch now · Disclosed · since 14 Sep 2026 · CVE-2026-73496
AI - closed6.8MCP servers & tools CVE-2026-55837: dbt-mcp OAuth helper exposes tokens without authentication
Patch now · Disclosed · since 14 Sep 2026 · CVE-2026-55837
AI - closed6.5MCP servers & tools CVE-2026-73497: MCP Atlassian server vulnerable to SSRF via DNS rebinding
Patch now · Disclosed · since 14 Sep 2026 · CVE-2026-73497
AI - closed8.8Langflow CVE-2026-78575: IBM Langflow OSS Command Execution via MCP Stdio Server
Patch now · Disclosed · since 10 Sep 2026 · CVE-2026-78575
AI - closed9.8Langflow CVE-2026-85025: IBM Langflow OSS Unauthenticated Code Execution via MCP Endpoints
Patch now · Disclosed · since 10 Sep 2026 · CVE-2026-85025
AI - closed6.2MCP SDKs MCP Kotlin SDK vulnerable to buffer growth denial of service
Patch now · Disclosed · since 9 Sep 2026 · CVE-2026-53937
AI - closed6.5Langflow CVE-2026-9186: IBM Langflow OSS localhost MCP configuration bypass
Patch now · Disclosed · since 4 Sep 2026 · CVE-2026-9186
AI - closed9.1MCP servers & tools CVE-2026-55640: Nextcloud MCP Server unauthenticated webhook vulnerability
Patch now · Disclosed · since 25 Aug 2026 · CVE-2026-55640
AI - closed8.7MCP SDKs CVE-2026-53965: MCP PHP SDK unbounded memory buffer vulnerability
Patch now · Disclosed · since 25 Aug 2026 · CVE-2026-53965
AI - closed7.1neuro-cortex-memory CVE-2026-49986: Cortex MCP Server vulnerability allows improper developer root validation
Patch now · Disclosed · since 14 Aug 2026 · CVE-2026-49986
AI - closed7.3MCP servers & tools CVE-2026-19753: Server-side request forgery in mcp-rdf-explorer MCP Server
Patch now · Disclosed · since 13 Aug 2026 · CVE-2026-19753
AI - closed9.0Flowise CVE-2026-73601: Remote code execution in Flowise Custom MCP node
Patch now · Disclosed · since 13 Aug 2026 · CVE-2026-73601
AI - closed7.7MCP servers & tools CVE-2026-73498: Path traversal flaw in MCP Atlassian server allows arbitrary file read
Patch now · Disclosed · since 12 Aug 2026 · CVE-2026-73498
AI - closed9.1MCP servers & tools CVE-2026-48039: Meta Ads MCP authentication bypass in middleware
Patch now · Disclosed · since 7 Aug 2026 · CVE-2026-48039
AI - closed9.3MCP servers & tools CVE-2026-67531: FrontMCP Sandbox Escape Leading to RCE
Patch now · Disclosed · since 6 Aug 2026 · CVE-2026-67531
AI - closed8.8Langflow CVE-2026-17623: Improper Validation in Langflow OSS Allows Arbitrary Command Execution
Patch now · Disclosed · since 5 Aug 2026 · CVE-2026-17623
AI - closed8.5Langflow CVE-2026-9077: Localhost Restriction Bypass in Langflow OSS Writes Arbitrary MCP Configs
Patch now · Disclosed · since 5 Aug 2026 · CVE-2026-9077
AI - closed7.5Langflow CVE-2026-8446: Authentication Bypass in Langflow OSS MCP Composer Endpoint
Patch now · Disclosed · since 5 Aug 2026 · CVE-2026-8446
AI - closed6.5Langflow CVE-2026-7646: Arbitrary file read vulnerability in IBM Langflow OSS
Patch now · Disclosed · since 5 Aug 2026 · CVE-2026-7646
AI - closed8.7Flowise Flowise patch bypass allows unauthenticated RCE via npm_config_yes
Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-69263
AI - closed6.2gemini-bridge CVE-2026-54785: Local file read vulnerability in gemini-bridge MCP server
Patch now · Disclosed · since 31 Jul 2026 · CVE-2026-54785
AI - closed9.8Langflow CVE-2026-12940: IBM Langflow OSS RCE via Environment Variable Injection
Patch now · Disclosed · since 30 Jul 2026 · CVE-2026-12940
AI - closed6.2MCP SDKs CVE-2026-63119: Unbounded IO Read Vulnerability in MCP Ruby SDK
Patch now · Disclosed · since 29 Jul 2026 · CVE-2026-63119
AI - closed7.5MCP SDKs CVE-2026-67432: Unbounded JSON-RPC Request Vulnerability in MCP Ruby SDK
Patch now · Disclosed · since 29 Jul 2026 · CVE-2026-67432
AI - closed5.3MCP SDKs CVE-2026-67430: Memory Exhaustion Vulnerability in MCP Ruby SDK
Patch now · Disclosed · since 29 Jul 2026 · CVE-2026-67430
AI - closed8.3MCP SDKs CVE-2026-67431: Session Hijacking Vulnerability in MCP Ruby SDK
Patch now · Disclosed · since 29 Jul 2026 · CVE-2026-67431
AI - closed6.9MCP SDKs CVE-2026-63118: DNS Rebinding Vulnerability in MCP Ruby SDK
Patch now · Disclosed · since 29 Jul 2026 · CVE-2026-63118
AI - closed7.7MCP servers & tools CVE-2026-46555: WhatsApp MCP Server Unauthenticated API Vulnerability
Patch now · Disclosed · since 20 Jul 2026 · CVE-2026-46555
AI - closed6.3MCP servers & tools CVE-2026-44968: dbt-mcp vulnerability allows flag injection in subprocess
Patch now · Disclosed · since 16 Jul 2026 · CVE-2026-44968
AI - closed2.5MCP servers & tools CVE-2026-44969: dbt-mcp logs sensitive tool arguments in plaintext
Patch now · Disclosed · since 16 Jul 2026 · CVE-2026-44969
AI - closed5.3Claude Code + SDKs CVE-2026-47751: Claude Code Action vulnerable to malicious MCP configuration
Patch now · Disclosed · since 16 Jul 2026 · CVE-2026-47751
AI - closed3.1MCP servers & tools CVE-2026-44970: dbt-mcp telemeters unredacted tool call arguments
Patch now · Disclosed · since 16 Jul 2026 · CVE-2026-44970
AI - closed9.8LiteLLM CVE-2026-30623: Remote code execution vulnerability in LiteLLM
Patch now · Disclosed · since 15 Jul 2026 · CVE-2026-30623
AI - closed7.6MCP SDKs CVE-2026-59950: MCP Python SDK WebSocket server lacks Host and Origin validation
Patch now · Disclosed · since 16 Jul 2026 · updated 16 Jul 2026 · CVE-2026-59950
AI - closed7.1MCP SDKs CVE-2026-52869: MCP Python SDK HTTP transports fail to verify authenticated principal
Patch now · Disclosed · since 16 Jul 2026 · updated 16 Jul 2026 · CVE-2026-52869
AI - closed7.6MCP SDKs CVE-2026-52870: MCP Python SDK experimental task handlers allow unauthorized task access
Patch now · Disclosed · since 16 Jul 2026 · updated 16 Jul 2026 · CVE-2026-52870
AI - closed9.2MCP servers & tools CVE-2026-15643: AWS HealthLake MCP Server SSRF Credential Exfiltration
Patch now · Disclosed · since 14 Jul 2026 · CVE-2026-15643
AI - closed10.0Ruflo Unauthenticated MCP Bridge Endpoint Exposure in Ruflo
Patch now · Disclosed · since 9 Jul 2026 · CVE-2026-59726
AI - closed7.4MCP servers & tools Kong Konnect MCP Server Indirect Prompt Injection Vulnerability
Patch now · Disclosed · since 3 Jul 2026 · CVE-2026-13341
AI - closed9.1Langflow CVE-2026-7663: IBM Langflow OSS MCP Resource Access Vulnerability
Patch now · Disclosed · since 30 Jun 2026 · CVE-2026-7663
AI - closed5.0Flowise CVE-2026-58057: Flowise custom MCP stdio environment variable bypass leads to RCE
Patch now · Disclosed · since 28 Jun 2026 · CVE-2026-58057
AI - closed9.9Flowise CVE-2026-56274: Flowise command injection vulnerability in Custom MCP Server
Patch now · Disclosed · since 23 Jun 2026 · CVE-2026-56274
AI - closed9.8Langflow CVE-2026-7664: Improper authorization flaw in IBM Langflow OSS
Patch now · Disclosed · since 22 Jun 2026 · CVE-2026-7664
AI - closed6.3LiteLLM CVE-2026-12774: SSRF vulnerability in BerriAI LiteLLM MCP server
Patch now · Disclosed · since 21 Jun 2026 · CVE-2026-12774
AI - closed7.3LiteLLM CVE-2026-12773: LiteLLM MCP Proxy Has Improper Authentication
Patch now · Disclosed · since 21 Jun 2026 · CVE-2026-12773
AI - closed9.4MCP SDKs CVE-2026-11624: Model Context Protocol lacks Origin header validation allowing DNS rebinding
Patch now · Disclosed · since 13 Jun 2026 · CVE-2026-11624
AI - closed8.8MCP servers & tools CVE-2026-46519: Access control bypass vulnerability in mcp-server-kubernetes
Patch now · Disclosed · since 11 Jun 2026 · CVE-2026-46519
AI - closed6.1MCP servers & tools CVE-2026-47250: mcp-server-kubernetes Privilege Escalation Vulnerability
Patch now · Disclosed · since 11 Jun 2026 · CVE-2026-47250
AI - closed9.6LibreChat CVE-2026-32625: LibreChat MCP Server Environment Variable Exfiltration Vulnerability
Patch now · Disclosed · since 2 Jun 2026 · CVE-2026-32625
AI - closed7.2MCP servers & tools Spring AI mcp-security Lacks Mandatory SSRF Mitigations
Patch now · Disclosed · since 29 May 2026 · CVE-2026-45609
AI - closed8.8MCP SDKs CVE-2026-42559: RMCP Streamable HTTP Server Host Header Validation Flaw
Patch now · Disclosed · since 14 May 2026 · CVE-2026-42559
AI - closedFlowise Flowise MCP security bypass leads to RCE
Patch now · Disclosed · since 14 May 2026
AI - closed8.8LiteLLM CVE-2026-42271: LiteLLM Authenticated Command Execution via MCP Endpoints
Patch now · Disclosed · since 25 Apr 2026 · updated 8 May 2026 · CVE-2026-42271
AI - closed9.4MCP servers & tools CVE-2026-40576: Path traversal in excel-mcp-server
Patch now · Disclosed · since 21 Apr 2026 · CVE-2026-40576
AI - closed8.7MCP servers & tools CVE-2026-39313: Denial of service vulnerability in mcp-framework HTTP transport
Patch now · Disclosed · since 16 Apr 2026 · CVE-2026-39313
AI - closed9.9Flowise CVE-2026-40933: Flowise Authenticated RCE via MCP Adapters
Patch now · Disclosed · since 16 Apr 2026 · updated 21 Apr 2026 · CVE-2026-40933
AI - closed8.3MCP servers & tools CVE-2026-39884: Argument Injection in Kubernetes MCP Server Port Forward Tool
Patch now · Disclosed · since 15 Apr 2026 · CVE-2026-39884
AI - closed8.6Langchain-Chatchat CVE-2026-30617: Remote Code Execution in LangChain-ChatChat MCP Server
Patch now · Disclosed · since 15 Apr 2026 · CVE-2026-30617
AI - closed8.0Windsurf CVE-2026-30615: Prompt Injection and RCE in Windsurf AI Editor
Patch now · Disclosed · since 15 Apr 2026 · CVE-2026-30615
AI - closed9.8OpenAI Codex CVE-2025-61260: OpenAI Codex CLI enables code execution via malicious MCP files
Patch now · Disclosed · since 14 Apr 2026 · CVE-2025-61260
AI - closed7.3Chatbox CVE-2026-6130: OS Command Injection in Chatbox AI MCP Server Management
Patch now · Disclosed · since 12 Apr 2026 · CVE-2026-6130
AI - closed8.1MCP servers & tools Apollo MCP Server Host Header Validation Vulnerability
Patch now · Disclosed · since 9 Apr 2026 · CVE-2026-35577
AI - closed7.5MCP servers & tools FrontMCP SSRF Vulnerability in OpenAPI Specification Processing
Patch now · Disclosed · since 8 Apr 2026 · CVE-2026-39885
AI - closed7.6MCP SDKs CVE-2026-35568: DNS rebinding vulnerability in MCP Java SDK
Patch now · Disclosed · since 7 Apr 2026 · CVE-2026-35568
AI - closed6.3MCP servers & tools CVE-2026-5470: SSRF Vulnerability in Google-Research-MCP Content Extractor
Patch now · Disclosed · since 3 Apr 2026 · CVE-2026-5470
AI - closed8.1MCP SDKs CVE-2026-34742: DNS Rebinding Vulnerability in Go MCP SDK
Patch now · Disclosed · since 2 Apr 2026 · CVE-2026-34742
AI - closed6.1MCP SDKs CVE-2026-34237: Hardcoded Wildcard CORS Vulnerability in MCP Java SDK
Patch now · Disclosed · since 31 Mar 2026 · CVE-2026-34237
AI - closedMCP SDKs Credential Exfiltration via Remote Poisoned MCP Tool
Research · since 1 Apr 2025
AI - closedMCP servers & tools Postmark MCP Server Package Hijacked for Email Exfiltration
Supply chain · Exploited · since Sep 2025 (approx.)
AI - closed8.2MCP SDKs CVE-2026-33946: MCP Ruby SDK session hijacking vulnerability
Patch now · Disclosed · since 27 Mar 2026 · CVE-2026-33946
AI - closed8.3MCP servers & tools CVE-2026-33980: Azure Data Explorer MCP Server KQL injection vulnerability
Patch now · Disclosed · since 27 Mar 2026 · CVE-2026-33980
AI - closed7.4FastMCP CVE-2025-69196: FastMCP OAuth Proxy Token Reuse
Patch now · Disclosed · since 16 Mar 2026 · CVE-2025-69196
AI - closed8.2MCP servers & tools MCP Atlassian unauthenticated server-side request forgery vulnerability
Patch now · Disclosed · since 10 Mar 2026 · CVE-2026-27826
AI - closed9.0MCP servers & tools MCP Atlassian directory traversal vulnerability allows arbitrary file write
Patch now · Disclosed · since 10 Mar 2026 · CVE-2026-27825
AI - closed6.4MCP servers & tools CVE-2026-27735: Path traversal vulnerability in Model Context Protocol git server
Patch now · Disclosed · since 26 Feb 2026 · CVE-2026-27735
AI - closed8.7MCP servers & tools CVE-2026-25650: MCP Salesforce Connector Auth Token Disclosure Vulnerability
Patch now · Disclosed · since 6 Feb 2026 · CVE-2026-25650
AI - closed7.8MCP servers & tools CVE-2026-25546: Godot MCP Command Injection Vulnerability
Patch now · Disclosed · since 4 Feb 2026 · CVE-2026-25546
AI - closed7.1MCP SDKs CVE-2026-25536: Model Context Protocol SDK cross-client data leak
Patch now · Disclosed · since 4 Feb 2026 · CVE-2026-25536
AI - closedCursor Data Exfiltration via MCP Server Prompt Injection Targeting Cursor
Research · since 24 Jun 2025
AI - closed9.65ire CVE-2026-22792: 5ire Unsafe HTML Rendering Leads to RCE
Patch now · Disclosed · since 21 Jan 2026 · CVE-2026-22792
AI - closed8.7MCP SDKs CVE-2026-0621: Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Patch now · Disclosed · since 5 Jan 2026 · CVE-2026-0621
AI - closed9.6MCP servers & tools CVE-2025-66580: Dive MCP Host Application RCE Vulnerability
Patch now · Disclosed · since 19 Dec 2025 · CVE-2025-66580
AI - closed7.7Zed CVE-2025-68433: Arbitrary code execution in Zed IDE via Model Context Protocol config
Patch now · Disclosed · since 17 Dec 2025 · CVE-2025-68433
AI - closed6.5MCP servers & tools CVE-2025-68143: Arbitrary path creation vulnerability in mcp-server-git
Patch now · Disclosed · since 17 Dec 2025 · CVE-2025-68143
AI - closedFastMCP FastMCP auth integration confused deputy issue
Patch now · Disclosed · since 29 Oct 2025
AI - closed5.4FastMCP CVE-2025-62801: FastMCP command injection in Cursor installer
Patch now · Disclosed · since 29 Oct 2025 · CVE-2025-62801
AI - closed5.3FastMCP CVE-2025-62800: FastMCP reflected XSS in oauth callback page
Patch now · Disclosed · since 29 Oct 2025 · CVE-2025-62800
AI - closed9.8Flowise CVE-2025-55346: Flowise vulnerable to RCE via Dynamic function constructor injection
Patch now · Disclosed · since 6 Oct 2025 · CVE-2025-55346
AI - closed6.9MCP servers & tools CVE-2025-59155: hackmd-mcp server-side request forgery vulnerability
Patch now · Disclosed · since 15 Sep 2025 · CVE-2025-59155
AI - closedFlowise Flowise unsandboxed remote code execution via Custom MCP
Patch now · Disclosed · since 15 Sep 2025
AI - closed10.0Flowise CVE-2025-59528: Flowise remote code execution via CustomMCP node
Patch now · Disclosed · since 15 Sep 2025 · updated 22 Sep 2025 · CVE-2025-59528
AI - closed8.6MCP SDKs CVE-2025-58444: MCP Inspector Vulnerable to Command Execution via XSS
Patch now · Disclosed · since 8 Sep 2025 · CVE-2025-58444
AI - closed9.65ire CVE-2025-58357: 5ire AI assistant content injection vulnerability
Patch now · Disclosed · since 4 Sep 2025 · CVE-2025-58357
AI - closed7.5MCP servers & tools CVE-2025-58358: Markdownify MCP server command injection vulnerability
Patch now · Disclosed · since 4 Sep 2025 · CVE-2025-58358
AI - closed9.8Flowise CVE-2025-8943: Flowise OS command remote code execution
Patch now · Disclosed · since 14 Aug 2025 · CVE-2025-8943
AI - closed6.3Agno CVE-2025-8665: OS command injection in Agno MCP Tools
Patch now · Disclosed · since 6 Aug 2025 · CVE-2025-8665
AI - closed7.5MCP servers & tools Command Injection in Lara Translate MCP Server
Patch now · Disclosed · since 21 Jul 2025 · CVE-2025-53832
AI - closed8.9MCP servers & tools Command Injection in GitHub Kanban MCP Server
Patch now · Disclosed · since 14 Jul 2025 · CVE-2025-53818
AI - closed7.5MCP servers & tools CVE-2025-53372: Command injection vulnerability in node-code-sandbox-mcp
Patch now · Disclosed · since 8 Jul 2025 · CVE-2025-53372
AI - closed8.7MCP SDKs CVE-2025-53366: MCP Python SDK FastMCP Server Denial of Service Vulnerability
Patch now · Disclosed · since 4 Jul 2025 · CVE-2025-53366
AI - closed8.7MCP SDKs CVE-2025-53365: MCP Python SDK Denial of Service via Streamable HTTP Transport
Patch now · Disclosed · since 4 Jul 2025 · CVE-2025-53365
AI - closed9.3MCP servers & tools CVE-2025-34072: Data exfiltration vulnerability in Anthropic Slack MCP Server
Patch now · Disclosed · since 2 Jul 2025 · CVE-2025-34072
AI - closed7.3MCP servers & tools CVE-2025-53109: Model Context Protocol filesystem server symlink handling bypass
Patch now · Disclosed · since 1 Jul 2025 · updated 2 Jul 2025 · CVE-2025-53109
AI - closed7.3MCP servers & tools CVE-2025-53110: Model Context Protocol filesystem server path validation bypass
Patch now · Disclosed · since 1 Jul 2025 · updated 2 Jul 2025 · CVE-2025-53110
AI - closed6.0MCP servers & tools CVE-2025-52573: iOS Simulator MCP Server Command Injection Vulnerability
Patch now · Disclosed · since 26 Jun 2025 · CVE-2025-52573
AI - closed9.4MCP SDKs CVE-2025-49596: MCP Inspector Authentication Bypass and RCE
Patch now · Disclosed · since 13 Jun 2025 · CVE-2025-49596
AI
2 more in the archive.