samanhappy MCPHub

• CVE-2026-120323 Medium 4.3 samanhappy MCPHub passthroughHeaders.ts information disclosure 0.4%
• CVE-2026-94047 Medium 6.3 samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management 0.4%
• CVE-2026-90474 Medium 6.8 MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass 0.6%
• CVE-2026-79743 Medium 6.9 MCPHub: Path Traversal via Malicious MCPB Manifest Name 0.5%
• CVE-2026-79744 High 8.8 MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration 0.6%
• CVE-2026-79745 High 7.1 MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources) 0.4%
• CVE-2026-79746 High 8.1 MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching 0.4%
• CVE-2026-79747 High 7.1 MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial) 0.3%
• CVE-2026-79748 Critical 9.9 MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args) 0.6%
• CVE-2026-79749 High 7.6 MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation 0.4%
• CVE-2026-79750 High 7.7 MCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF) 0.4%
• CVE-2025-11287 High 7.3 samanhappy MCPHub sseService.ts handleSseConnectionfunction improper authentication 0.6%
• CVE-2025-11286 Medium 4.7 samanhappy MCPHub MCPRouter Service serverController.ts server-side request forgery 0.3%
• CVE-2025-11285 Medium 6.3 samanhappy MCPHub serverController.ts os command injection 7.9%