Alibaba
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Fastjson | 2 | – | Jul 23, 2026 |
| nacos | 2 | – | Apr 27, 2021 |
| Alibaba Cloud RDS OpenAPI MCP Server | 1 | – | Jul 28, 2026 |
Exploited and recent CVEs
- CVE-2026-9680 MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server 0.4%
- CVE-2026-16723 Remote Code Execution in fastjson 1.2.68–1.2.83 0.7%
- CVE-2025-70974 Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that 0.7%
- CVE-2021-29441 Authentication bypass 83.2%
- CVE-2021-29442 Authentication bypass 64.2%