MCP protocol, SDKs and registry

1. Nov 5, 2026Mediumpatched

   Unvalidated runtimeArguments and identifier in server.json import & unvalidated URL scheme in web ElicitationUrlModalBody

   MCP Inspector · GHSA-rwv7-mh2c-ff2p

   MCP protocol, SDKs and registry
2. Nov 5, 2026Medium 6.1patched

   MCP App escapes its CSP by navigating its own frame

   MCP Inspector · GHSA-h9j8-vj8g-v3gg

   MCP protocol, SDKs and registry
3. Nov 4, 2026Medium 6.5patched

   MCP Inspector can stall on a malicious tool output schema regex.

   MCP Inspector · GHSA-2fw8-7jmw-r937

   MCP protocol, SDKs and registry
4. Nov 3, 2026High 7.5patched

   Missing user ID claims collapse authenticated principals and allow MCP session hijacking

   MCP C# SDK · GHSA-x863-g495-4cjc

   MCP protocol, SDKs and registry
5. Oct 28, 2026Medium 5.3patched

   mcp-server-git: nested gitdir file bypasses --repository confinement

   MCP reference servers · GHSA-w766-5x43-whvw

   MCP protocol, SDKs and registry
6. Oct 25, 2026Medium 6.3patched

   fetch: private-address guard bypass via IDNA hostnames (check and connect resolve different names)

   MCP reference servers · GHSA-v38p-wf49-hx2j

   MCP protocol, SDKs and registry
7. Oct 25, 2026Medium 6.5patched

   Cross-Origin Environment Variable Exfiltration in @modelcontextprotocol/server-everything

   MCP reference servers · GHSA-mvf5-2qqv-rg3c

   MCP protocol, SDKs and registry
8. Oct 25, 2026Low 3.1patched

   @modelcontextprotocol/server-filesystem list_directory_with_sizes follows symlinks and leaks outside-directory file metadata

   MCP reference servers · GHSA-hhwq-wxfx-cj7g

   MCP protocol, SDKs and registry
9. Oct 25, 2026Medium 4.2patched

   Path traversal via trailing quote/whitespace in validatePath (Check/Use Mismatch)

   MCP reference servers · GHSA-7rgq-gccq-qphx

   MCP protocol, SDKs and registry
10. Oct 25, 2026Low 3.1patched

    fetch server: SSRF guard treats the well-known NAT64 prefix 64:ff9b::/96 as public, so a metadata address is reachable on NAT64/DNS64 egress

    MCP reference servers · GHSA-66qx-2266-pmj6

    MCP protocol, SDKs and registry
11. Oct 25, 2026Low 2.2patched

    Parent-Directory Fallback TOCTOU in @modelcontextprotocol/server-filesystem Permits Arbitrary File Write Outside allowedDirectories

    MCP reference servers · GHSA-53mr-w429-c597

    MCP protocol, SDKs and registry
12. Oct 25, 2026Medium 5.3patched

    Case-variant path bypasses symlink check and allows creating files outside allowed directories in server-filesystem

    MCP reference servers · GHSA-4gxg-m5jx-9j57

    MCP protocol, SDKs and registry
13. Oct 25, 2026Low 3.1patched

    robots.txt enforcement bypass via HTTP redirects in mcp-server-fetch

    MCP reference servers · GHSA-3jqg-r5pp-rmp2

    MCP protocol, SDKs and registry
14. Oct 21, 2026High 7.5patched

    Missing Authentication for Critical Function in @modelcontextprotocol/inspector

    MCP Inspector · GHSA-wmjf-2m46-2352

    MCP protocol, SDKs and registry
15. Oct 21, 2026Highpatched

    Incomplete fix for CVE-2025-49596: DNS-rebinding info disclosure (API token + stored OAuth tokens) in MCP Inspector

    MCP Inspector · GHSA-vcc9-3xgm-p9v4

    MCP protocol, SDKs and registry
16. Oct 21, 2026High 8.8patched

    A remote MCP server can execute arbitrary code on the user's machine through the OAuth authorization URL (PowerShell subexpression injection on Windows and WSL)

    MCP Inspector · GHSA-q978-78c7-phqw

    MCP protocol, SDKs and registry
17. Oct 21, 2026Mediumpatched

    MCP Inspector v2.7.0 — /api/fetch proxy has no size cap on the proxied response body (memory-exhaustion DoS)

    MCP Inspector · GHSA-m5pj-3536-3xcp

    MCP protocol, SDKs and registry
18. Oct 21, 2026Mediumpatched

    /fetch proxy leaks Authorization/Cookie headers across cross-origin redirects (regression from the SSRF hardening in v1.0.0)

    MCP Inspector · GHSA-f6mc-jg3x-vq53

    MCP protocol, SDKs and registry
19. Oct 21, 2026Lowpatched

    SSE auth/custom headers are logged verbatim by the Inspector proxy

    MCP Inspector · GHSA-8qgq-27v6-55w3

    MCP protocol, SDKs and registry
20. Oct 21, 2026Critical 9.6patched

    Remote MCP App can steal proxy auth token and execute arbitrary local commands (RCE)

    MCP Inspector · GHSA-6x67-4w4w-9f3w

    MCP protocol, SDKs and registry
21. Oct 21, 2026Critical 9.6patched

    Malicious MCP OAuth callback can switch transport to stdio and execute arbitrary local commands (RCE)

    MCP Inspector · GHSA-4fc4-wcmh-4g86

    MCP protocol, SDKs and registry
22. Oct 21, 2026Medium 5.3patched

    MCP Inspector leaks proxy session token to query-controlled proxy origin

    MCP Inspector · GHSA-2rq8-f55p-j2jp

    MCP protocol, SDKs and registry
23. Oct 20, 2026Medium 5.3patched

    Server/client session dispatch returns raw handler exception messages (and the full cause chain) to the peer → information disclosure

    MCP Java SDK · GHSA-w83x-jw8h-w4rj

    MCP protocol, SDKs and registry
24. Oct 20, 2026High 7.1patched

    Default stateless Servlet transport accepts browser cross-origin tool calls

    MCP Java SDK · GHSA-hp8w-r5wh-cw9q

    MCP protocol, SDKs and registry
25. Oct 20, 2026Highpatched

    Unbounded session retention in the Streamable HTTP transport allows an initialize flood DoS

    MCP Java SDK · GHSA-2hm9-qff2-hrpj

    MCP protocol, SDKs and registry
26. Oct 15, 2026High 7.7patched

    Shared transport or server instances delivered one HTTP client's messages to another

    MCP TypeScript SDK · CVE-2026-111770 · GHSA-jm63-cq47-j5jp

    MCP protocol, SDKs and registry
27. Oct 15, 2026High 7.5patched

    HTTP server transports and handlers did not limit request body size or JSON-RPC batch length

    MCP TypeScript SDK · GHSA-f897-62hf-6gxq

    MCP protocol, SDKs and registry
28. Oct 15, 2026High 7.5patched

    One HTTP request within the default size limit could exhaust server memory during validation

    MCP TypeScript SDK · CVE-2026-111768 · GHSA-46jr-4wx8-v453

    MCP protocol, SDKs and registry
29. Oct 5, 2026Medium 6.8patched

    Server bearer-token authentication accepts tokens issued for a different resource server

    MCP Python SDK · CVE-2026-116684 · GHSA-w4fh-qvv9-3v23

    MCP protocol, SDKs and registry
30. Oct 5, 2026Medium 6.8patched

    Server bearer authentication accepted tokens issued for another service

    MCP TypeScript SDK · CVE-2026-111771 · GHSA-rvq5-wwqv-78pq

    MCP protocol, SDKs and registry
31. Oct 2, 2026Medium 6.5patched

    HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

    MCP TypeScript SDK · CVE-2026-111769 · GHSA-6prh-2h8m-c8cw

    MCP protocol, SDKs and registry
32. Oct 2, 2026Medium 5.9patched

    HTTP client transports followed cross-origin redirects carrying custom headers and bodies

    MCP Python SDK · CVE-2026-116685 · GHSA-5h93-6whr-6q8j

    MCP protocol, SDKs and registry
33. Oct 2, 2026High 8.6patched

    Experimental tasks were not tied to the session that created them

    MCP TypeScript SDK · CVE-2026-111767 · GHSA-22jm-h49p-29qw

    MCP protocol, SDKs and registry
34. Sep 30, 2026High 7.5patched

    HTTP server transports and OAuth endpoints read request bodies with no size limit

    MCP Python SDK · CVE-2026-109527 · GHSA-fmmv-w9g8-j3gc

    MCP protocol, SDKs and registry
35. Sep 30, 2026High 7.5patched

    Streamable HTTP sessions were never reclaimed by default and kept their initialize payloads

    MCP Python SDK · CVE-2026-59951 · GHSA-84m7-p3x7-pcfv

    MCP protocol, SDKs and registry
36. Sep 30, 2026High 7.5patched

    OAuth client could send credentials to an authorization server chosen by the MCP server

    MCP TypeScript SDK · CVE-2026-104850 · GHSA-6qxp-vccf-f47h

    MCP protocol, SDKs and registry
37. Sep 28, 2026Medium 6.5patched

    Client fetched server-chosen $ref URLs while validating tool results against output schemas

    MCP Python SDK · CVE-2026-116686 · GHSA-rwrf-2pqf-9j8j

    MCP protocol, SDKs and registry
38. Sep 28, 2026High 7.5patched

    OAuth client could send credentials to an authorization server chosen by the MCP server

    MCP Python SDK · CVE-2026-115563 · GHSA-qx49-fqc8-xw99

    MCP protocol, SDKs and registry
39. Aug 19, 2026Medium 6.5patched

    Unbounded reads when parsing Server-Sent Events in HTTP client transports

    MCP Java SDK · GHSA-5q7x-232h-f834

    MCP protocol, SDKs and registry
40. Aug 19, 2026High 7.5patched

    Unbounded request-body reads in mcp-core HTTP server transports allow remote denial of service (CWE-770)

    MCP Java SDK · CVE-2026-108395 · GHSA-4x8c-5vv7-973f

    MCP protocol, SDKs and registry

Filter all 189 in the database →

Recent updates

1. Nov 5, 2026Security

   MCP Inspector: Unvalidated runtimeArguments and identifier in server.json import & unvalidated URL scheme in web ElicitationUrlModalBody

   Medium. Status: patched. GHSA-rwv7-mh2c-ff2p. MCP Inspector advisory.

   Source ↗

2. Nov 5, 2026Security

   MCP Inspector: MCP App escapes its CSP by navigating its own frame

   Medium (CVSS 6.1). Status: patched. GHSA-h9j8-vj8g-v3gg. MCP Inspector advisory.

   Source ↗

3. Nov 4, 2026Security

   MCP Inspector: MCP Inspector can stall on a malicious tool output schema regex.

   Medium (CVSS 6.5). Status: patched. GHSA-2fw8-7jmw-r937. MCP Inspector advisory.

   Source ↗

4. Nov 3, 2026Security

   MCP C# SDK: Missing user ID claims collapse authenticated principals and allow MCP session hijacking

   High (CVSS 7.5). Status: patched. GHSA-x863-g495-4cjc. MCP C# SDK advisory.

   Source ↗

5. Oct 28, 2026Security

   MCP reference servers: mcp-server-git: nested gitdir file bypasses --repository confinement

   Medium (CVSS 5.3). Status: patched. GHSA-w766-5x43-whvw. MCP reference servers advisory.

   Source ↗

6. Oct 25, 2026Security

   MCP reference servers: fetch: private-address guard bypass via IDNA hostnames (check and connect resolve different names)

   Medium (CVSS 6.3). Status: patched. GHSA-v38p-wf49-hx2j. MCP reference servers advisory.

   Source ↗

7. Oct 25, 2026Security

   MCP reference servers: Cross-Origin Environment Variable Exfiltration in @modelcontextprotocol/server-everything

   Medium (CVSS 6.5). Status: patched. GHSA-mvf5-2qqv-rg3c. MCP reference servers advisory.

   Source ↗

8. Oct 25, 2026Security

   MCP reference servers: @modelcontextprotocol/server-filesystem list_directory_with_sizes follows symlinks and leaks outside-directory file metadata

   Low (CVSS 3.1). Status: patched. GHSA-hhwq-wxfx-cj7g. MCP reference servers advisory.

   Source ↗

9. Oct 25, 2026Security

   MCP reference servers: Path traversal via trailing quote/whitespace in validatePath (Check/Use Mismatch)

   Medium (CVSS 4.2). Status: patched. GHSA-7rgq-gccq-qphx. MCP reference servers advisory.

   Source ↗

10. Oct 25, 2026Security

    MCP reference servers: fetch server: SSRF guard treats the well-known NAT64 prefix 64:ff9b::/96 as public, so a metadata address is reachable on NAT64/DNS64 egress

    Low (CVSS 3.1). Status: patched. GHSA-66qx-2266-pmj6. MCP reference servers advisory.

    Source ↗

Other tools