MCP-In-SoS: Risk Assessment Framework for Open-Source MCP Servers

Model Context Protocol MCP servers have rapidly emerged over the past year as a widely adopted way to enable Large Language Model LLM agents to access dynamic, real-world tools. As MCP servers proliferate and become easy to adopt via open-source releases, understanding their security risks become...

@oneuptime/cli (>=10.0.5, <=10.0.19), @oneuptime/common-server (>=7.0.141, <=7.0.2936) +4 more potentially affected by CVE-2026-30921 via @oneuptime/common (>=7.0.141, <=10.0.19)

@oneuptime/common NPM version =7.0.141, =10.0.5, =7.0.141, =7.0.141, =7.0.141, =7.0.4774, =7.0.141, =7.0.2928 Source cves: CVE-2026-30921 Source advisory: MEND:CVE-2026-30921...

@oneuptime/cli (>=10.0.5, <=10.0.18), @oneuptime/common-server (>=7.0.141, <=7.0.2936) +4 more potentially affected by CVE-2026-30920 via @oneuptime/common (>=7.0.141, <=10.0.18)

@oneuptime/common NPM version =7.0.141, =10.0.5, =7.0.141, =7.0.141, =7.0.141, =7.0.4774, =7.0.141, =7.0.2928 Source cves: CVE-2026-30920 Source advisory: MEND:CVE-2026-30920...

@oneuptime/cli (>=10.0.5, <=10.0.17), @oneuptime/common-server (>=7.0.141, <=7.0.2936) +4 more potentially affected by CVE-2026-30887 via @oneuptime/common (>=7.0.141, <=10.0.17)

@oneuptime/common NPM version =7.0.141, =10.0.5, =7.0.141, =7.0.141, =7.0.141, =7.0.4774, =7.0.141, =7.0.2928 Source cves: CVE-2026-30887 Source advisory: MEND:CVE-2026-30887...

@oneuptime/cli (>=10.0.5, <=10.0.18) potentially affected by CVE-2026-30920 via @oneuptime/common (>=10.0.5, <=10.0.18)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.18 Source cves: CVE-2026-30920 Source advisory: SNYK:JS-ONEUPTIMECOMMON-15518692...

Missing Authorization

Overview @oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c Affected...

@oneuptime/cli (>=10.0.5, <=10.0.18) potentially affected by CVE-2026-30920 via @oneuptime/common (>=10.0.5, <=10.0.18)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.18 Source cves: CVE-2026-30920 Source advisory: OSV:GHSA-656W-6F6C-M9R6...

@oneuptime/cli (>=10.0.5, <=10.0.18) potentially affected by CVE-2026-30920 via @oneuptime/common (>=10.0.5, <=10.0.18)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.18 Source cves: CVE-2026-30920 Source advisory: GHSA-656W-6F6C-M9R6...

CVE-2002-0059

creationtimestamp| type| source ---|---|--- 2026-03-09 17:15:08+00:00| seen| https://gist.github.com/verdurin/ec4ecbbbe37c7ae1f4a79c34dbdb6793...

airflow-parse-bench (>=0.0.1, <=1.0.1), apache-airflow-providers-common-compat (>=1.0.0, <=1.5.1) potentially affected by CVE-2025-69219 via apache-airflow-providers-http (5.4.0)

apache-airflow-providers-http PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-http and may be impacted: - airflow-parse-bench =0.0.1, =1.0.0, =1.5.1 Source cves: CVE-2025-69219 Source advisory:...

CVE-2025-70047

An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in Nexusoft NexusInterface v3.2.0-beta.2...

PT-2026-24069

An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in Nexusoft NexusInterface v3.2.0-beta.2...

CVE-2026-29790

dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that...

Exposed Dangerous Method or Function

Overview @oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c Affected...

@oneuptime/cli (>=10.0.5, <=10.0.19) potentially affected by CVE-2026-30921 via @oneuptime/common (>=10.0.5, <=10.0.19)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.19 Source cves: CVE-2026-30921 Source advisory: OSV:GHSA-4J36-39GM-8VQ8...

@oneuptime/cli (>=10.0.5, <=10.0.20) potentially affected by CVE-2026-30921 via @oneuptime/common (>=10.0.5, <=10.0.20)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.20 Source cves: CVE-2026-30921 Source advisory: SNYK:JS-ONEUPTIMECOMMON-15444918...

@oneuptime/cli (>=10.0.5, <=10.0.19) potentially affected by CVE-2026-30921 via @oneuptime/common (>=10.0.5, <=10.0.19)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.19 Source cves: CVE-2026-30921 Source advisory: GHSA-4J36-39GM-8VQ8...

Arbitrary Code Injection

Overview @oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c Affected...

@oneuptime/cli (>=10.0.5, <=10.0.17) potentially affected by CVE-2026-30887 via @oneuptime/common (>=10.0.5, <=10.0.17)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.17 Source cves: CVE-2026-30887 Source advisory: GHSA-H343-GG57-2Q67...

@oneuptime/cli (>=10.0.5, <=10.0.17) potentially affected by CVE-2026-30887 via @oneuptime/common (>=10.0.5, <=10.0.17)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.17 Source cves: CVE-2026-30887 Source advisory: SNYK:JS-ONEUPTIMECOMMON-15440733...