CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

143742 matches found

osv_clsa•added 2026/10/14 5:56 p.m.•19 views

CLSA-2026-1792000560 TuxCare security update for http-proxy-middleware (2 CVEs)

TuxCare rebuilt http-proxy-middleware to address 2 CVEs. Fixed in 4.0.0-tuxcare.1...

8.6CVSS5.9AI score0.00378EPSS

SaveExploits2

CVE•added 2026/10/14 5:52 p.m.•60 views

CVE-2026-109527

The Model Context Protocol Python SDK is vulnerable to a memory exhaustion Denial of Service (DoS) in versions before 1.29.1 and from 2.0.0a1 through 2.0.1 . The vulnerability exists because the Streamable HTTP session manager , SSE message endpoint , and OAuth authorization-server routes buffer ...

7.5CVSS6.1AI score0.007EPSS

SaveExploits0References7

Cvelist•added 2026/10/14 5:52 p.m.•45 views

CVE-2026-109527 Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

7.5CVSS0.007EPSS

SaveExploits0References7

Debian CVE•added 2026/10/14 5:52 p.m.•8 views

CVE-2026-109527

7.5CVSS6.1AI score0.007EPSS

SaveExploits0

EUVD•added 2026/10/14 5:52 p.m.•15 views

EUVD-2026-101514

7.5CVSS6.1AI score0.007EPSS

SaveExploits0References7

osv_cve•added 2026/10/14 5:52 p.m.•23 views

CVE-2026-109527 Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies

7.5CVSS6.2AI score

SaveExploits0References9

EUVD•added 2026/10/14 5:46 p.m.•30 views

EUVD-2026-101503

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

7.5CVSS6AI score0.00608EPSS

SaveExploits0References8

Cvelist•added 2026/10/14 5:46 p.m.•37 views

CVE-2026-108395 Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies

7.5CVSS0.00608EPSS

SaveExploits0References8

Mend•added 2026/10/14 5:46 p.m.•13 views

CVE-2026-108395

8.7CVSS6AI score0.00608EPSS

SaveExploits0References8

Vulnrichment•added 2026/10/14 5:46 p.m.•13 views

CVE-2026-108395 Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies

7.5CVSS6AI score0.00608EPSS

SaveExploits0References8

osv_cve•added 2026/10/14 5:46 p.m.•39 views

CVE-2026-108395 Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies

7.5CVSS6AI score

SaveExploits0References10

RedhatCVE•added 2026/10/14 5:25 p.m.•19 views

CVE-2026-92392

A flaw was found in curl. When curl uploads data over an HTTP/2 connection, it mishandles server stream reset frames, which can lead to the reuse of previously released memory. Under specific memory and timing conditions, a malicious server can exploit this flaw to execute arbitrary code on the...

8.1CVSS8.2AI score0.01284EPSS

SaveExploits1References3

NVD•added 2026/10/14 5:18 p.m.•16 views

CVE-2026-59951

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamablehttpapp, and StreamableHTTPSessionManager, retain session entries without an id...

6.9CVSS0.00458EPSS

SaveExploits0References7

NVD•added 2026/10/14 5:18 p.m.•10 views

CVE-2026-105659

Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants mor...

8.7CVSS0.00616EPSS

SaveExploits0References5

osv_cve•added 2026/10/14 4:54 p.m.•22 views

CVE-2026-105659 HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit

8.7CVSS6AI score0.00616EPSS

SaveExploits0References10

osv_eef•added 2026/10/14 4:54 p.m.•33 views

EEF-CVE-2026-105659 HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit

Summary Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer...

8.7CVSS5.8AI score0.00616EPSS

SaveExploits0References5

EUVD•added 2026/10/14 4:54 p.m.•13 views

EUVD-2026-101380

8.7CVSS6AI score0.00616EPSS

SaveExploits0References5

CVE•added 2026/10/14 4:54 p.m.•31 views

CVE-2026-105659

The mtrudel bandit library (version 1.4.0 and onward) is vulnerable to an Uncontrolled Resource Consumption vulnerability. An unauthenticated remote attacker can pin HTTP/2 stream processes indefinitely by sending a trickle of small WINDOW_UPDATE frames. The root cause is that the Bandit.HTTP2.Co...

8.7CVSS6AI score0.00616EPSS

SaveExploits0References5

Cvelist•added 2026/10/14 4:54 p.m.•43 views

CVE-2026-105659 HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit

8.7CVSS0.00616EPSS

SaveExploits0References5

Mend•added 2026/10/14 4:22 p.m.•12 views

CVE-2026-59951

6.9CVSS5.8AI score0.00458EPSS

SaveExploits0References8

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by