Modelcontextprotocol - vulnerabilities (CVEs)

48 CVEs in 19 products, 10 in the last 30 days, newest from 2026-10-27.

Products

• Python-sdk - 11 CVEs
• Ruby-sdk - 6 CVEs
• Servers - 6 CVEs
• Registry - 5 CVEs
• Rust-sdk - 4 CVEs
• Typescript-sdk - 4 CVEs
• Go-sdk - 3 CVEs
• Inspector - 2 CVEs
• Java-sdk - 2 CVEs
• Io.modelcontextprotocol.sdkmcp - 1 CVEs
• Io.modelcontextprotocol.sdkmcp-core - 1 CVEs
• Io.modelcontextprotocolkotlin-sdk - 1 CVEs
• Io.modelcontextprotocolkotlin-sdk-client - 1 CVEs
• Io.modelcontextprotocolkotlin-sdk-core - 1 CVEs
• Io.modelcontextprotocolkotlin-sdk-server - 1 CVEs
• Kotlin-sdk - 1 CVEs
• Mcp-server-everything - 1 CVEs
• Mcp-server-fetch - 1 CVEs
• Php-sdk - 1 CVEs

Newest CVEs of Modelcontextprotocol

• CVE-2026-116686 - CVSS 6.5 (medium), 2026-10-27: The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0,…
• CVE-2026-116685 - CVSS 5.9 (medium), 2026-10-27: The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0,…
• CVE-2026-116684 - CVSS 6.8 (medium), 2026-10-27: The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0,…
• CVE-2026-111767 - CVSS 8.6 (high), 2026-10-20: MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the…
• CVE-2026-109527 - CVSS 7.5 (high), 2026-10-14: The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from…
• CVE-2026-108395 - CVSS 7.5 (high), 2026-10-14: The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the…
• CVE-2026-59951 - CVSS 6.9 (medium), 2026-10-14: The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable…
• CVE-2026-108714 - CVSS 8.7 (high), 2026-10-11: MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because…
• CVE-2026-104850 - CVSS 7.5 (high), 2026-10-06: MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and…
• CVE-2026-104120 - CVSS 7.3 (high), 2026-10-02: A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function…
• CVE-2026-64684 - CVSS 6.8 (medium), 2026-09-16: RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in…
• CVE-2026-63127 - CVSS 8.2 (high), 2026-09-16: RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits…
• CVE-2026-63128 - CVSS 7.5 (high), 2026-09-16: RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in…
• CVE-2026-53937 - CVSS 6.2 (medium), 2026-09-08: MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, `ReadBuffer.append` in…
• CVE-2026-53965 - CVSS 6.9 (medium), 2026-08-25: The MCP PHP SDK (Composer package mcp/sdk) is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport…
• CVE-2026-67432 - CVSS 7.5 (high), 2026-07-29: MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the…
• CVE-2026-67431 - CVSS 8.3 (high), 2026-07-29: MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the…
• CVE-2026-63119 - CVSS 6.2 (medium), 2026-07-29: MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and…
• CVE-2026-67430 - CVSS 5.3 (medium), 2026-07-29: MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the…
• CVE-2026-63118 - CVSS 6.9 (medium), 2026-07-29: MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the…
• CVE-2026-59950 - CVSS 8.1 (high), 2026-07-15: The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated…
• CVE-2026-52870 - CVSS 7.6 (high), 2026-07-15: The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed…
• CVE-2026-52869 - CVSS 7.1 (high), 2026-07-15: The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP…
• CVE-2026-44428 - CVSS 4.7 (medium), 2026-05-14: The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub…
• CVE-2026-44427 - CVSS 0 (none), 2026-05-14: The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4, the TrailingSlashMiddleware in…
• CVE-2026-45781 - CVSS 3.5 (low), 2026-05-14: The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips…
• CVE-2026-44430 - CVSS 6.3 (medium), 2026-05-14: The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace…
• CVE-2026-44429 - CVSS 5.4 (medium), 2026-05-14: The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET /…
• CVE-2026-42559 - CVSS 8.8 (high), 2026-05-14: RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport…
• CVE-2026-35568 - CVSS 7.6 (high), 2026-04-07: MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk contains a DNS rebinding vulnerability.…