By year
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Latest high and critical flaws
- CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients.High 8.6 · Oct 20, 2026
- CVE-2026-109527 The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients.High 7.5 · Oct 14, 2026
- CVE-2026-108395 The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients.High 7.5 · Oct 14, 2026
- CVE-2026-108714 MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mHigh 8.7 · Oct 11, 2026
- CVE-2026-104850 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients.High 7.5 · Oct 6, 2026
- CVE-2026-63128 RMCP is an official Rust SDK for the Model Context Protocol.High 7.5 · Sep 16, 2026
- CVE-2026-63127 RMCP is an official Rust SDK for the Model Context Protocol.High 8.2 · Sep 16, 2026
- CVE-2026-67432 MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients.High 7.5 · Jul 29, 2026
- CVE-2026-67431 MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients.High 8.3 · Jul 29, 2026
- CVE-2026-59950 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP).High 7.6 · Jul 15, 2026
- CVE-2026-52870 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP).High 7.6 · Jul 15, 2026
- CVE-2026-52869 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP).High 7.1 · Jul 15, 2026
- CVE-2026-42559 RMCP is an official Rust SDK for the Model Context Protocol.High 8.8 · May 14, 2026
- CVE-2026-35568 MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients.High 7.6 · Apr 7, 2026
- CVE-2026-34742 The Go MCP SDK used Go's standard encoding/json.High 7.6 · Apr 2, 2026
- CVE-2026-33946 MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients.High 8.2 · Mar 27, 2026
- CVE-2026-33252 The Go MCP SDK used Go's standard encoding/json.High 7.1 · Mar 23, 2026
- CVE-2026-27896 The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1.High 7 · Feb 25, 2026
- CVE-2026-25536 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients.High 7.1 · Feb 4, 2026
- CVE-2025-66416 The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP).High 7.6 · Dec 2, 2025
- CVE-2025-66414 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients.High 7.6 · Dec 2, 2025
- CVE-2025-58444 The MCP inspector is a developer tool for testing and debugging MCP servers.High 8.6 · Sep 8, 2025
- CVE-2025-53366 The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP).High 8.7 · Jul 4, 2025
- CVE-2025-53365 The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP).High 8.7 · Jul 4, 2025
- CVE-2025-53110 Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP).High 7.3 · Jul 2, 2025
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.