CVE-2026-0621 MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS

Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service ReDoS vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested...

CVE-2026-0621

CVE-2026-0621 affects Anthropic’s MCP TypeScript SDK up to v1.25.1. The vulnerability is a ReDoS in the UriTemplate class when processing RFC 6570 exploded array patterns, where the generated regex uses nested quantifiers that can backtrack catastrophically. Exploitation requires sending a crafte...

Command Injection

Serverless Framework is vulnerable to Command Injection. The vulnerability is due to unsanitized user input being passed to childprocess.exec in the experimental MCP server feature, which allows an attacker to inject shell metacharacters and execute arbitrary system commands with the privileges o...

PT-2026-25819

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.2 Description Glances, a system cross-platform monitoring tool, had insufficient host validation in its main REST/WebUI FastAPI application prior to version 4.5.2. This allowed the REST API, WebUI, and token...

@burger-editor/blocks (>=4.0.0-alpha.1 <=4.0.0-alpha.7), @burger-editor/client (>=4.0.0-alpha.1 <=4.0.0-alpha.7) +4 more potentially affected by unknown CVE via trix (>=2.0.10 <=2.1.15)

trix NPM version =2.0.10, =4.0.0-alpha.1, =4.0.0-alpha.1, =4.0.0-alpha.1, =4.0.0-alpha.5, =4.0.0-alpha.1, =1.0.1, =1.0.3 Source cves: unknown CVE Source advisory: SNYK:JS-TRIX-14825036...

CVE-2025-69256

The Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications. Starting in version 4.29.0 and prior to version 4.29.3, a command injection vulnerability exists in the Serverless Framework's built-in MCP server package @serverless/mcp. This...

CVE-2025-69256 serverless MCP Server vulnerable to command injection in list-projects tool

The Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications. Starting in version 4.29.0 and prior to version 4.29.3, a command injection vulnerability exists in the Serverless Framework's built-in MCP server package @serverless/mcp. This...

CVE-2025-69256 serverless MCP Server vulnerable to command injection in list-projects tool

The Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications. Starting in version 4.29.0 and prior to version 4.29.3, a command injection vulnerability exists in the Serverless Framework's built-in MCP server package @serverless/mcp. This...

CVE-2025-69256 serverless MCP Server vulnerable to command injection in list-projects tool

The Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications. Starting in version 4.29.0 and prior to version 4.29.3, a command injection vulnerability exists in the Serverless Framework's built-in MCP server package @serverless/mcp. This...

CVE-2025-69256

CVE-2025-69256 : The Serverless Framework MCP Server vulnerability enables command injection via unsanitized user input in the list-projects tool. The issue arises when building shell commands with workspaceRoots (user-controlled) and calling child_process.exec without proper sanitization, allowi...

EUVD-2025-205459

FastMCP updated to MCP 1.23+ due to CVE-2025-66416...

GHSA-RCFX-77HG-W2WV FastMCP updated to MCP 1.23+ due to CVE-2025-66416

There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416. FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions 1.23 that were vulnerable to CVE-2025-66416. Users should upgrad...

FastMCP updated to MCP 1.23+ due to CVE-2025-66416

There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416. FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions 1.23 that were vulnerable to CVE-2025-66416. Users should upgrad...

@acabai/android (>=1.0.0 <=2.0.6), @acabai/core (>=1.0.0 <=1.0.6) +926 more potentially affected by CVE-2025-68665 via @langchain/core (>=0.0.0 <=0.3.8)

@langchain/core NPM version =0.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.6, =1.0.5, =0.1.2, =0.0.1, =1.2.27, =0.1.7, =3.0.0-beta.65.0, =8.0.0, =10.0.0, =11.0.0 and more Source cves: CVE-2025-68665 Source advisory: OSV:GHSA-R399-636X-V7F6...

EUVD-2025-204878

Malicious code in excluder-mcp npm...

Malicious code in excluder-mcp-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44e8a4074afa107f60ef1b93a1b5ad90b034338e5d94eed6d5b1e27fa583b96e The package excluder-mcp-package was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-204877

Malicious code in excluder-mcp-package npm...

Malicious code in excluder-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fbd667834f24295390990aca17b0c31962c9bb73f4db2d623c731d5bea052ca The package excluder-mcp was found to contain malicious code. Source: ghsa-malware 442683f846ae1a5ed8b7212f648fa722d3fc7f0e82af81258c74731d441e7b30 A...

Malicious Package

Overview excluder-mcp is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-192746 Malicious code in excluder-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fbd667834f24295390990aca17b0c31962c9bb73f4db2d623c731d5bea052ca The package excluder-mcp was found to contain malicious code. Source: ghsa-malware 442683f846ae1a5ed8b7212f648fa722d3fc7f0e82af81258c74731d441e7b30 A...