Log in Start free

@modelcontextprotocol

Products

ProductCVEsExploitedLatest
python-sdk11–Oct 27, 2026
typescript-sdk8–Nov 5, 2026
servers6–Feb 25, 2026
ruby-sdk6–Jul 29, 2026
registry5–May 14, 2026
rust-sdk4–Sep 16, 2026
sdk3–Nov 5, 2026
server3–Nov 5, 2026
inspector3–Oct 29, 2026
go-sdk3–Apr 2, 2026
java-sdk2–Apr 7, 2026
php-sdk1–Aug 25, 2026
server-legacy1–Nov 5, 2026
mcp-server-everything1–Oct 2, 2026
express1–Nov 5, 2026
io.modelcontextprotocol.sdk:mcp1–Oct 14, 2026
io.modelcontextprotocol.sdk:mcp-core1–Oct 14, 2026
io.modelcontextprotocol:kotlin-sdk1–Sep 8, 2026
io.modelcontextprotocol:kotlin-sdk-client1–Sep 8, 2026
io.modelcontextprotocol:kotlin-sdk-core1–Sep 8, 2026
io.modelcontextprotocol:kotlin-sdk-server1–Sep 8, 2026
kotlin-sdk1–Oct 11, 2026
client1–Nov 5, 2026
mcp-server-fetch1–Oct 2, 2026

Exploited and recent CVEs

  • CVE-2026-111770 High 7.7 Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another 0.4%
  • CVE-2026-111770 High 7.7 Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another 0.4%
  • CVE-2026-111768 High 7.5 Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation 0.6%
  • CVE-2026-111768 High 7.5 Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation 0.6%
  • CVE-2026-111768 High 7.5 Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation 0.6%
  • CVE-2026-111769 Medium 6.5 Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies 0.4%
  • CVE-2026-111769 Medium 6.5 Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies 0.4%
  • CVE-2026-111769 Medium 6.5 Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies 0.4%
  • CVE-2026-111771 Medium 6.8 Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service 0.5%
  • CVE-2026-111771 Medium 6.8 Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service 0.5%
  • CVE-2026-111771 Medium 6.8 Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service 0.5%
  • CVE-2026-111771 Medium 6.8 Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service 0.5%
  • CVE-2026-111771 Medium 6.8 Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service 0.5%
  • CVE-2026-119025 High 7.5 open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows 1.4%
  • CVE-2026-116686 Medium 6.5 Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas 0.3%
  • CVE-2026-116685 Medium 5.9 Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies 0.4%
  • CVE-2026-116684 Medium 6.8 Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server 0.4%
  • CVE-2026-111767 High 8.6 MCP TypeScript SDK: Experimental tasks were not tied to the session that created them 0.3%
  • CVE-2026-109527 High 7.5 Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies 0.7%
  • CVE-2026-108395 High 7.5 Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies 0.6%
  • CVE-2026-108395 High 7.5 Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies 0.6%
  • CVE-2026-59951 Medium 6.9 MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion 0.5%
  • CVE-2026-108714 High 7.5 MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket 0.4%
  • CVE-2026-104850 High 7.5 MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server 0.2%
  • CVE-2026-104120 High 7.3 modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery 0.3%
  • CVE-2026-104120 High 7.3 modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery 0.3%
  • CVE-2026-64684 Medium 6.8 RMCP: Custom HTTP headers leak to cross-origin redirect targets 0.5%
  • CVE-2026-63127 High 8.2 RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery 0.2%
  • CVE-2026-63128 High 7.5 RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service 0.5%
  • CVE-2026-53937 Medium 6.2 MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS) 0.2%