12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2547 more potentially affected by CVE-2025-66414 via @modelcontextprotocol/sdk (>=1.0.0, <=1.23.1)

@modelcontextprotocol/sdk NPM version =1.0.0, =0.3.3, =1.0.0, =0.1.0, =1.14.1, =0.1.0, =1.0.0, =1.2.1, =0.1.4, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.1, =0.0.1, =0.0.26-beta.1 and more Source cves: CVE-2025-66414 Source advisory: SNYK:JS-MODELCONTEXTPROTOCOLSDK-14171914...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2547 more potentially affected by CVE-2025-66414 via @modelcontextprotocol/sdk (>=1.0.0, <=1.23.1)

@modelcontextprotocol/sdk NPM version =1.0.0, =0.3.3, =1.0.0, =0.1.0, =1.14.1, =0.1.0, =1.0.0, =1.2.1, =0.1.4, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.1, =0.0.1, =0.0.26-beta.1 and more Source cves: CVE-2025-66414 Source advisory: GHSA-W48Q-CV73-MX4W...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2547 more potentially affected by CVE-2025-66414 via @modelcontextprotocol/sdk (>=1.0.0, <=1.23.1)

@modelcontextprotocol/sdk NPM version =1.0.0, =0.3.3, =1.0.0, =0.1.0, =1.14.1, =0.1.0, =1.0.0, =1.2.1, =0.1.4, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.1, =0.0.1, =0.0.26-beta.1 and more Source cves: CVE-2025-66414 Source advisory: OSV:GHSA-W48Q-CV73-MX4W...

@arturl/pulumi-mcp-server (0.1.9), @collegue/mcp (>=1.0.1, <=1.0.2) +71 more potentially affected by CVE-2025-58444 via @modelcontextprotocol/inspector (>=0.2.7, <=0.15.0)

@modelcontextprotocol/inspector NPM version =0.2.7, =1.0.1, =2.0.10, =0.0.0-semantically-released, =1.0.1, =0.0.0-alpha.0, =0.1.0, =0.1.0, =2.1.0, =2.1.1 - @iflow-mcp/cliffhall-gooseteam 0.3.0 - @iflow-mcp/dify-mcp-server-ts 1.0.0 - @iflow-mcp/dify-workflow-mcp 1.0.0 and more Source cves:...

NuGet Package 'ModelContextProtocol' Detection

The remote host has a 'ModelContextProtocol' with a Verified NuGet package status and is installed on the remote host. Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...

@flinkhouse/servers (0.6.2), @iflow-mcp/leadfarmer-ai-mcp-server-example (>=1.0.0, <=1.0.2) +3 more potentially affected by CVE-2025-34072 via @modelcontextprotocol/server-slack (2025.4.25)

@modelcontextprotocol/server-slack NPM version 2025.4.25 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/server-slack and may be impacted: - @flinkhouse/servers 0.6.2 - @iflow-mcp/leadfarmer-ai-mcp-server-example =1.0.0, =1.0.0,...

@flinkhouse/servers (0.6.2), @iflow-mcp/alibabacloud-dataworks-mcp-server (1.0.43) +9 more potentially affected by CVE-2025-53109 via @modelcontextprotocol/server-filesystem (>=0.6.2, <=2025.3.28)

@modelcontextprotocol/server-filesystem NPM version =0.6.2, =1.0.0, =0.5.0, =0.6.2, =1.0.7, =2.0.1, =0.1.7, =0.2.9 Source cves: CVE-2025-53109 Source advisory: MEND:CVE-2025-53109...

@flinkhouse/servers (0.6.2), @iflow-mcp/alibabacloud-dataworks-mcp-server (1.0.43) +9 more potentially affected by CVE-2025-53110 via @modelcontextprotocol/server-filesystem (>=0.6.2, <=2025.3.28)

@modelcontextprotocol/server-filesystem NPM version =0.6.2, =1.0.0, =0.5.0, =0.6.2, =1.0.7, =2.0.1, =0.1.7, =0.2.9 Source cves: CVE-2025-53110 Source advisory: MEND:CVE-2025-53110...

@kakashi-ventures-accelerator/catalyst-cli (0.1.0), @mew-protocol/mew (>=0.5.0, <=0.11.0) +1 more potentially affected by CVE-2025-53110 via @modelcontextprotocol/server-filesystem (0.6.2)

@modelcontextprotocol/server-filesystem NPM version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/server-filesystem and may be impacted: - @kakashi-ventures-accelerator/catalyst-cli 0.1.0 - @mew-protocol/mew =0.5.0, =0.11....

@iflow-mcp/alibabacloud-dataworks-mcp-server (1.0.43), @mseep/alibabacloud-dataworks-mcp-server (1.0.36) +1 more potentially affected by CVE-2025-53109 via @modelcontextprotocol/server-filesystem (2025.3.28)

@modelcontextprotocol/server-filesystem NPM version 2025.3.28 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/server-filesystem and may be impacted: - @iflow-mcp/alibabacloud-dataworks-mcp-server 1.0.43 -...

Remote Code Execution (RCE)

@modelcontextprotocol/inspector is vulnerable to Remote Code Execution RCE. The vulnerability is due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio...

@cyanheads/git-mcp-server (>=2.0.10, <=2.1.0), @dsazz/mcp-confluence (0.2.0) +34 more potentially affected by CVE-2025-49596 via @modelcontextprotocol/inspector (>=0.2.7, <=0.13.0)

@modelcontextprotocol/inspector NPM version =0.2.7, =2.0.10, =1.0.1, =0.0.0-alpha.0, =1.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2025-49596 Source advisory: OSV:GHSA-7F8R-222P-6F5G...