modelcontextprotocol Latest High & Critical Vulnerabilities
Latest High & Critical vulnerabilities published by modelcontextprotocol
Vulnerability Published:
🗓️ Published
- Anytime
Sort By:
🗓️ Published Date
- Descending
Session Management Flaw in MCP TypeScript SDK Affects Multiple Versions
CVE-2026-111767ModelcontextprotocolTypescript-sdk8.6HIGHMemory Exhaustion Vulnerability in Model Context Protocol Python SDK
CVE-2026-109527ModelcontextprotocolPython-sdk7.5HIGHMemory Flooding Vulnerability in Model Context Protocol SDK by Model Context Protocol
CVE-2026-108395ModelcontextprotocolIo.modelcontextprotoco...7.5HIGHUncontrolled Memory Allocation in MCP Kotlin SDK by Model Context Protocol
CVE-2026-108714ModelcontextprotocolKotlin-sdk8.7HIGHOAuth Vulnerability in MCP TypeScript SDK Affecting Model Context Protocol Servers
CVE-2026-104850ModelcontextprotocolTypescript-sdk7.5HIGHOAuth Implementation Flaw in RMCP Rust SDK Affects Model Context Protocol
CVE-2026-63127ModelcontextprotocolRust-sdk8.2HIGHVulnerability in Rust SDK's Streamable HTTP Server Affects Model Context Protocol Products
CVE-2026-63128ModelcontextprotocolRust-sdk7.5HIGHSession ID Binding Issue in MCP Ruby SDK by Model Context Protocol
CVE-2026-67431ModelcontextprotocolRuby-sdk8.3HIGHWebSocket Handshake Vulnerability in MCP Python SDK by Model Context Protocol
CVE-2026-59950ModelcontextprotocolPython-sdk7.6HIGHImproper Task Handling in Python SDK by Model Context Protocol
CVE-2026-52870ModelcontextprotocolPython-sdk7.6HIGHVulnerability in MCP Python SDK Affects JSON-RPC Message Security
CVE-2026-52869ModelcontextprotocolPython-sdk7.1HIGHVulnerability in RMCP Rust SDK Allows DNS Rebinding Attacks on MCP Servers
CVE-2026-42559ModelcontextprotocolRust-sdk👾🟡8.8HIGHDNS Rebinding Vulnerability in MCP Java SDK by Model Context Protocol
CVE-2026-35568ModelcontextprotocolJava-sdk7.6HIGHDNS Rebinding Vulnerability in Go MCP SDK by Model Context Protocol
CVE-2026-34742ModelcontextprotocolGo-sdk7.6HIGHSession Hijacking Vulnerability in Ruby SDK for Model Context Protocol
CVE-2026-33946ModelcontextprotocolRuby-sdk8.2HIGHCross-Site Request Forgery in Go MCP SDK from Model Context Protocol
CVE-2026-33252ModelcontextprotocolGo-sdk7.1HIGHCase Sensitivity Issue in Go MCP SDK by Model Context Protocol
CVE-2026-27896ModelcontextprotocolGo-sdk7HIGHCross-Client Data Leak in MCP TypeScript SDK Version 1.10.0 to 1.25.3
CVE-2026-25536ModelcontextprotocolTypescript-sdk7.1HIGHDNS Rebinding Vulnerability in MCP Python SDK by Model Context Protocol
CVE-2025-66416ModelcontextprotocolPython-sdk7.6HIGHDNS Rebinding Vulnerability in MCP TypeScript SDK
CVE-2025-66414ModelcontextprotocolTypescript-sdk7.6HIGHCross-Site Scripting Vulnerability in MCP Inspector Tool by Model Context Protocol
CVE-2025-58444ModelcontextprotocolInspector8.6HIGHValidation Error in MCP Python SDK Causing Service Disruption
CVE-2025-53366ModelcontextprotocolPython-sdk8.7HIGHUncaught Resource Error in Model Context Protocol Python SDK
CVE-2025-53365ModelcontextprotocolPython-sdk8.7HIGHUnintended File Access Risk in Model Context Protocol Servers by Model Context Protocol
CVE-2025-53109ModelcontextprotocolServers7.3HIGHFilesystem Vulnerability in Model Context Protocol Servers
CVE-2025-53110ModelcontextprotocolServers7.3HIGH