Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-rqfv-2mw9-78g2
  • PyPI/mysql-mcp-server
 MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure) 2 days ago
  • Fix available
  • Severity - 10.0 (Critical)
PYSEC-2026-3866
  • PyPI/nextcloud-mcp-server
 nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default ) 4 days ago
  • Fix available
  • Severity - 9.1 (Critical)
PYSEC-2026-3915
  • PyPI/qwed-mcp
 qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input 4 days ago
  • Fix available
  • Severity - 9.8 (Critical)
PYSEC-2026-3862
  • PyPI/mcp-contextforge-gateway
 mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server 4 days ago
  • Fix available
  • Severity - 10.0 (Critical)
GHSA-vwf3-4xxj-qg6h
  • PyPI/mcp-contextforge-gateway
 mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment 25 Aug
  • Fix available
GHSA-8vh3-g2qg-2h2c
  • PyPI/nextcloud-mcp-server
 nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default ) 25 Aug
  • Fix available
  • Severity - 9.1 (Critical)
GHSA-mw6r-2hvm-4rp2
  • PyPI/qwed-mcp
 qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input 25 Aug
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-xm98-3vcf-fph7
  • PyPI/mcp-contextforge-gateway
 mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server 24 Aug
  • Fix available
  • Severity - 10.0 (Critical)
PYSEC-2026-3684
  • PyPI/mcp-contextforge-gateway
 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`) 19 Aug
  • Fix available
  • Severity - 6.6 (Medium)
PYSEC-2026-3700
  • PyPI/stata-mcp
 MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install` 19 Aug
  • Fix available
  • Severity - 8.4 (High)
PYSEC-2026-3685
  • PyPI/mcp-server-kubernetes
 mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials 19 Aug
  • Fix available
  • Severity - 9.3 (Critical)
PYSEC-2026-3683
  • PyPI/mcp-atlassian
 mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment 19 Aug
  • Fix available
  • Severity - 7.7 (High)
GHSA-9hgc-g3w5-67cm
  • PyPI/mcp-contextforge-gateway
 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`) 14 Aug
  • Fix available
  • Severity - 6.6 (Medium)
GHSA-49m4-vp58-wgc9
  • PyPI/stata-mcp
 MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install` 12 Aug
  • Fix available
  • Severity - 8.4 (High)
PYSEC-2026-3549
  • PyPI/awslabs-aws-api-mcp-server
 AWS API MCP Server Security Policy Bypass via Startup Initialization Failure 04 Aug
  • Fix available
  • Severity - 7.3 (High)
PYSEC-2026-3579
  • PyPI/mysql-mcp-server
 MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler 04 Aug
  • Fix available
  • Severity - 2.1 (Low)
Load more...