pentest-mcp

Pentest MCP 专业渗透测试 MCP 服务器，支持现代传输/认证和扩展的侦察工具集。 0.9.0 版本变更 将 MCP SDK 升级到 @modelcontextprotocol/sdk@^1.26.0 将 MCP Inspector 保持在最新版本（@modelcontextprotocol/inspector@^0.20.0），并附带打包启动器 Streamable HTTP 现为主要网络传输方式（MCPTRANSPORT=http） SSE 仅作为已弃用的兼容模式保留 新增 Bearer Token 认证，支持 OIDC JWKS 和内省...

blitzstrike

Blitz Strike 高速侦察。深度分析。报告前验证。 Blitz Strike 是一套结构化的渗透测试方法论——侦察、源码分析与验证——以通用 MCP 服务器的形式交付。它枚举攻击面（BLITZ），追踪从 source 到 sink 的可达性（EAGLE-EYE），并在报告前对每个发现进行实时验证（STRIKE）。一个服务器，适配所有 agent：从范围约束到可直接提交的发现，只需一次 调用，且每个结果都会附带相关的漏洞利用工具手册。...

SUSE CVE-2026-34742

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol MCP Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPHandler or...

CVE-2026-42449 n8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. In versions 2.47.4 through 2.47.13, the SDK embedder path N8NDocumentationMCPServer constructor, getN8nApiClient, and validateInstanceContext, the synchronous URL validator in...

EUVD-2026-14643

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site POST requests without validating the Origin header and without requiring Content-Type: application/json. In deployments without Authorization,...

CVE-2026-33252 MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site POST requests without validating the Origin header and without requiring Content-Type: application/json. In deployments without Authorization,...

CVE-2026-27896

A flaw was found in the Go MCP SDK. This issue occurs due to an improper handling of case sensitivity during JSON-RPC message parsing, specifically in the matching of JSON keys to struct field tags. This behavior violates the JSON-RPC 2.0 specification, which explicitly requires case-sensitive...

CVE-2026-27896

The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would also match "Method", "METHOD", etc...

CVE-2025-53366 MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability 500 errors until manually...

CVE-2025-53366 MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability 500 errors until manually...

CVE-2025-53366

CVE-2025-53366 relates to the MCP Python SDK (PyPI: mcp). Before version 1.9.4, a validation error can trigger an unhandled exception when processing malformed requests, resulting in service unavailability (HTTP 500) that requires manual restart. The issue varies by deployment conditions and resi...