CVE-2025-47274 ToolHive stores secrets in the state store with no encryption

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol MCP servers. Due to the ordering of code used to start an MCP server container, versions of ToolHive prior to 0.0.33 inadvertently store secrets in the run config files which are used to restart...

PT-2025-20705 · Toolhive · Toolhive

Name of the Vulnerable Software and Affected Versions: ToolHive versions prior to 0.0.33 Description: The issue arises from the ordering of code used to start a Model Context Protocol MCP server container in ToolHive, inadvertently storing secrets in run config files. This allows an attacker with...

Firecrawl-Mcp-Server - Official Firecrawl MCP Server - Adds Powerful Web Scraping To Cursor, Claude And Any Other LLM Clients

A Model Context Protocol MCP server implementation that integrates with Firecrawl for web scraping capabilities. Big thanks to @vrknetha, @cawstudios for the initial implementation! You can also play around with our MCP Server on MCP.so's playground. Thanks to MCP.so for hosting and @gstarwd for...

Introducing the MCP Server for Wiz: Smarter AI Context, Stronger Cloud Security

Unified model context, real-time security answers, and a faster path to remediation...

rails-mcp-server

Rails MCP Server A Ruby implementation of a Model Context Pro...

bigstarter (>=0.1.0, <=0.1.1), grasp-mcp-server (>=3.11.0, <=3.21.0) +2 more potentially affected by unknown CVE via kuzu (>=0.5.0, <=0.7.1)

kuzu NPM version =0.5.0, =0.1.0, =3.11.0, =0.0.4, =1.0.3, =1.1.4 Source cves: unknown CVE Source advisory: SNYK:JS-KUZU-12179283...

bigstarter (>=0.1.0, <=0.1.1), grasp-mcp-server (>=3.11.0, <=3.21.0) +2 more potentially affected by unknown CVE via kuzu (>=0.5.0, <=0.7.1)

kuzu NPM version =0.5.0, =0.1.0, =3.11.0, =0.0.4, =1.0.3, =1.1.4 Source cves: unknown CVE Source advisory: SNYK:JS-KUZU-11502184...