Firecrawl-Mcp-Server - Official Firecrawl MCP Server - Adds Powerful Web Scraping To Cursor, Claude And Any Other LLM Clients

A Model Context Protocol MCP server implementation that integrates with Firecrawl for web scraping capabilities. Big thanks to @vrknetha, @cawstudios for the initial implementation! You can also play around with our MCP Server on MCP.so's playground. Thanks to MCP.so for hosting and @gstarwd for...

CVE-2025-4144

PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/27...

@iflow-mcp/git-mcp (1.0.0), mtmag (0.0.1) +4 more potentially affected by CVE-2025-4144 via @cloudflare/workers-oauth-provider (0.0.2)

@cloudflare/workers-oauth-provider NPM version 0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @cloudflare/workers-oauth-provider and may be impacted: - @iflow-mcp/git-mcp 1.0.0 - mtmag 0.0.1 - mtmaiadmin =0.0.694, =0.0.1, =0.8.11, =0.8.17 Source...

GHSA-QGP8-V765-QXX9 @cloudflare/workers-oauth-provider PKCE bypass via downgrade attack

Summary PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework. However, it was found that an attacker could cause the check to be skipped. Impact PKCE is a defense-in-depth mechanism against certain kinds of attacks and was an optional extension ...

@iflow-mcp/git-mcp (1.0.0), mtmag (0.0.1) +4 more potentially affected by CVE-2025-4143 via @cloudflare/workers-oauth-provider (0.0.2)

@cloudflare/workers-oauth-provider NPM version 0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @cloudflare/workers-oauth-provider and may be impacted: - @iflow-mcp/git-mcp 1.0.0 - mtmag 0.0.1 - mtmaiadmin =0.0.694, =0.0.1, =0.8.11, =0.8.17 Source...

Duplicate Advisory: @cloudflare/workers-oauth-provider PKCE bypass via downgrade attack

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qgp8-v765-qxx9. This link is maintained to preserve external references. Original Description PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework...

CVE-2025-4144

PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/27...

CVE-2025-4144

CVE-2025-4144 affects Cloudflare’s MCP-based workers-oauth-provider. A flaw in the PKCE implementation allows an attacker to bypass PKCE verification, effectively bypassing PKCE protection. Descriptions across sources (Veracode, Red Hat, GHSA advisories, OSV) state that the OAuth check can be ski...

CVE-2025-4144 PKCE bypass via downgrade attack

PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/27...

CVE-2025-4144 PKCE bypass via downgrade attack

PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/27...

CVE-2025-4143: URL Redirection to Untrusted Site

The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that redirecturi was on the allowed list of redirect URIs for the given client registration. Fixed in: ...

PT-2025-18345 · Unknown · Workers-Oauth-Provider

Name of the Vulnerable Software and Affected Versions: workers-oauth-provider affected versions not specified Description: The issue is related to the OAuth implementation in workers-oauth-provider, part of the MCP framework. An attacker could cause the PKCE check to be skipped, completely...

CVE-2025-4144: Improper Authentication

PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/27...

Researchers Demonstrate How MCP Prompt Injection Can Be Used for Both Attack and Defense

As the field of artificial intelligence AI continues to evolve at a rapid pace, fresh research has found how techniques that render the Model Context Protocol MCP susceptible to prompt injection attacks could be used to develop security tooling or identify malicious tools, according to a new repo...

Introducing the MCP Server for Wiz: Smarter AI Context, Stronger Cloud Security

Unified model context, real-time security answers, and a faster path to remediation...

This Week in Spring - April 15th, 2025

Spring AI M7 is here! This new release includes a bunch of awesome new features! And some refactorings. Notably that the Spring AI auto-configuration has changed from a single monolithic artifact to individual auto-configuration artifacts per model, vector store, and other components. This change...

Securing Spring AI MCP servers with OAuth2

Spring AI offers support for Model Context Protocol, or MCP for short, which allows AI models to interact with and access external tools and resources in a structured way. With Spring AI, developers can create their own MCP Servers and expose capabilities to AI models in just a few lines of code...

PT-2025-25442

Name of the Vulnerable Software and Affected Versions MCP Inspector versions prior to 0.14.1 Description MCP Inspector is a developer tool used for testing and debugging Model Context Protocol MCP servers. It consists of a client providing an interactive interface and a proxy server that bridges...

This Week in Spring – March 18th, 2025

Hi, Spring fans! I just got back from the amazing JavaOne show held in Redwood Shores. It was a fun, uproarious event and a great chance to reconnect with tons of friends, old and new. I love this community! One of the central highlights of this show? Java 24 is here, finally! And, as usual, we'v...

bigstarter (>=0.1.0, <=0.1.1), grasp-mcp-server (>=3.11.0, <=3.21.0) +2 more potentially affected by unknown CVE via kuzu (>=0.5.0, <=0.7.1)

kuzu NPM version =0.5.0, =0.1.0, =3.11.0, =0.0.4, =1.0.3, =1.1.4 Source cves: unknown CVE Source advisory: SNYK:JS-KUZU-12179283...