CVE-2026-77255

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira updateissue attachments argument is converted into local paths and routed to the attachment upload implementation without workspace validation. A caller can make the MCP serv...

CVE-2026-77243 MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, ENABLEDTOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that knows a hidden tool name can directly invoke...

CVE-2026-77267 mcp-atlassian has an incomplete SSRF remediation

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by processauthenticationheaders and used to construct Atlassian fetchers without calling...

CVE-2026-77267 mcp-atlassian has an incomplete SSRF remediation

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by processauthenticationheaders and used to construct Atlassian fetchers without calling...

CVE-2026-77270 MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled filepath values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassia...

CVE-2026-77269: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the remediation for CVE-2026-27825 protects download destinations but does not constrain source paths used by attachment uploads. A caller can provide an absolute or traversal filepat...

cve-mcp-server

cve-mcp-server Realtime CVE intelligence over the Model Conte...

CVE-2026-93982: Insertion of Sensitive Information into Log File

OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and acces...

CVE-2026-63127

A flaw was found in rmcp, a Rust SDK for the Model Context Protocol. The OAuth implementation in rmcp omits the RFC 9728 resource field from ResourceServerMetadata. This allows a malicious Model Context Protocol MCP server to publish metadata for a different legitimate MCP resource. Consequently,...

When Agents Look like Beacons: NIDS Evasion by Model Context Protocol Traffic

The Model Context Protocol MCP standardizes communication between autonomous Artificial Intelligence AI agents and remote tools over Streamable HTTP. This shift introduces a class of machine-generated, authenticated, and high-frequency JSON-RPC traffic directly into enterprise networks. Enterpris...

Measuring and Exploiting Implicit Trust in LLM Tool-Calling Pipelines

The Model Context Protocol MCP enables LLMs to invoke external tools, but every tool interaction exposes the model to attacker-controlled text through multiple input channels tool descriptions, tool results, sampling messages that share a single context window without privilege separation. In thi...

Characterizing Network Centralization and Observability in the Remote MCP Ecosystem

The Model Context Protocol MCP has emerged as the dominant interface for connecting autonomous agents to external data sources and execution environments. The ecosystem's transition from local process execution to remote Streamable HTTP deployments introduces unmeasured architectural and security...

CVE-2026-61559 @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable ENABLEDYNAMICAPIURL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab A...

CVE-2026-54688

CVE-2026-54688 is a Server-Side Request Forgery (SSRF) in mcp-searxng , a Model Context Protocol server providing AI assistants with web search and URL-reading via SearXNG. Prior to 1.2.0 , the web_url_read tool passes a caller-supplied URL to a server-side fetch path, but the internal-address gu...

CVE-2026-58201

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

PT-2026-91161

Name of the Vulnerable Software and Affected Versions Bifrost HTTP transport versions prior to 2.1.0 Description Bifrost allows the registration of MCP clients through its management API, where a stdio client consists of a command and arguments. The software starts the program in the gateway...

inspector v2.6.0

MCP Inspector A developer tool for inspecting Model Context Protocol MCP servers. It ships as a single package, @modelcontextprotocol/inspector, that provides four ways to inspect a server: Web — a Vite + React + Mantine single-page app with a Node backend. CLI — a scriptable command-line client...

SUSE CVE-2026-11624

The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new "--allowed-hosts" flag was introduced...

NPM: CodeWhale: js_execution leaks parent environment to model context via missing env scrub

NPM: CodeWhale: jsexecution leaks parent environment to model context via missing env scrub vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...

CVE-2026-85606: Improper Limitation of a Pathname to a Restricted Directory

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawlparse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like...