Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
CVE-2026-102242
  • github.com/googleapis/mcp-toolbox
 Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for... 29 Sep
  • No fix available
  • Severity - 8.6 (High)
GO-2026-6411
  • Go/github.com/googleapis/mcp-toolbox
 MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints in github.com/googleapis/mcp-toolbox 10 Sep
  • Fix available
CVE-2026-14541
  • github.com/googleapis/mcp-toolbox
 Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider 31 Jul
  • No fix available
  • Severity - 8.0 (High)
CVE-2026-14540
  • github.com/googleapis/mcp-toolbox
 Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox 31 Jul
  • Fix available
  • Severity - 8.0 (High)
CVE-2026-14539
  • github.com/googleapis/mcp-toolbox
 Denial of Service via Unrestricted Payload Buffering in MCP Toolbox 31 Jul
  • Fix available
  • Severity - 6.6 (Medium)
CVE-2026-14538
  • github.com/googleapis/mcp-toolbox
 BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox 31 Jul
  • No fix available
  • Severity - 5.7 (Medium)
CVE-2026-14537
  • github.com/googleapis/mcp-toolbox
 Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints 31 Jul
  • No fix available
  • Severity - 8.1 (High)
CVE-2026-16481
  • github.com/googleapis/mcp-toolbox
 Server-Side Request Forgery (SSRF) and Credential Exfiltration in... 27 Jul
  • Fix available
  • Severity - 6.0 (Medium)
CVE-2026-15829
  • github.com/googleapis/mcp-toolbox
 SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox 21 Jul
  • No fix available
  • Severity - 8.6 (High)
GO-2026-5870
  • Go/github.com/googleapis/mcp-toolbox
 MCP Toolbox for Databases vulnerable to DNS rebinding attacks in github.com/googleapis/mcp-toolbox 07 Jul
  • Fix available
GHSA-vwxw-jrg6-9jxv
  • Go/github.com/googleapis/mcp-toolbox
 MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints 29 Jun
  • Fix available
  • Severity - 9.3 (Critical)
CVE-2026-11720
  • github.com/googleapis/mcp-toolbox
 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder 29 Jun
  • Fix available
  • Severity - 9.3 (Critical)
GO-2026-5706
  • Go/github.com/googleapis/mcp-toolbox
 googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) in github.com/googleapis/mcp-toolbox 25 Jun
  • Fix available
GO-2026-5251
  • Go/github.com/googleapis/mcp-toolbox
 googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) in github.com/googleapis/mcp-toolbox 25 Jun
  • Fix available
GO-2026-5144
  • Go/github.com/googleapis/mcp-toolbox
 MCP Toolbox for Databases: authenticated authorization bypass in github.com/googleapis/mcp-toolbox 25 Jun
  • Fix available
GHSA-5gf6-gc35-xjpc
  • Go/github.com/googleapis/mcp-toolbox
 MCP Toolbox for Databases: authenticated authorization bypass 18 Jun
  • Fix available
  • Severity - 8.6 (High)
Load more...