Hub/AI Security/Advisories
AI tool, plugin and MCP security advisories
182 GitHub Security Advisories published by the vendors and MCP maintainers we track, plus 7 sourced incidents and research disclosures. Severity and CVSS come straight from the advisory. "Not rated" means no score was published. Dates are publish dates in UTC as GitHub lists them.
- Entries
- 189
- Critical
- 11
- With a CVE
- 148
- GHSA last pulled
- 2026-11-04
11 critical · 114 high · 45 medium · 12 low · 7 not rated
How this list is built
scripts/fetch_advisories.py pulls published advisories from the GitHub REST API for 31 repositories and packages. Microsoft's VS Code feed is filtered to AI, agent and MCP advisories. Incidents without a GHSA, like malicious marketplace uploads, are added by hand from the vendor's own notice or the researcher's write-up. New IDs appear in /updates and the RSS feed on the next refresh.
Weekly, free
What changed in AI integrations
One short email when MCP clients, plugin ecosystems, IDE integrations, AI plan prices or security advisories change. Every item is sourced.