SUSE CVE-2026-47427

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

GO-2026-6118 GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler in github.com/github/github-mcp-server

GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler in github.com/github/github-mcp-server...

GO-2026-4569 vulnerabilities

Vulnerabilities for packages: opencost, github-mcp-server, datadog-agent, jaeger, ferretdb, gptscript, osv-scanner...

CVE-2026-47427: NULL Pointer Dereference

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

GO-2026-5779 GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server

GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server...

CVE-2026-48529

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from differe...

CVE-2026-48529 GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from differe...

CVE-2026-48529: Improper Access Control

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from differe...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: aws-network-policy-agent, flux-helm-controller, clickhouse-operator, supercronic, volume-modifier-for-k8s, newrelic-k8s-metadata-injection, spire-server, karpenter, external-secrets-operator, stakater-reloader, flux-image-reflector-controller, victoriametrics-cluster...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, external-secrets-operator-fips, atlas, envoy-ratelimit, cilium-certgen-fips, aws-network-policy-agent, dkron, podinfo-fips, local-path-provisioner-fips, mariadb-operator, malcontent, nodetaint, victoriametrics-cluster, omni-fips,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, external-secrets-operator-fips, atlas, envoy-ratelimit, cilium-certgen-fips, aws-network-policy-agent, dkron, podinfo-fips, local-path-provisioner-fips, mariadb-operator, malcontent, nodetaint, victoriametrics-cluster, omni-fips,...