CVE-2026-109527

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-109527

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-109527

The Model Context Protocol Python SDK is vulnerable to a memory exhaustion Denial of Service (DoS) in versions before 1.29.1 and from 2.0.0a1 through 2.0.1 . The vulnerability exists because the Streamable HTTP session manager , SSE message endpoint , and OAuth authorization-server routes buffer ...

EUVD-2026-101514

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-109527 Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-109527: Allocation of Resources Without Limits or Throttling

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-83700

Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally...

CVE-2026-83701

Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally...

CVE-2026-83701

A Use after free vulnerability exists in the Windows Now Playing Session Manager . This flaw allows an authorized attacker to achieve local privilege escalation . No specific exploit details or in-the-wild exploitation information are provided in the documents. Remediation is indicated as an OFFI...

CVE-2026-83700

A Use after free vulnerability exists in the Windows Now Playing Session Manager . This flaw allows an authorized attacker to perform a local elevation of privilege . No specific exploit details or remediation steps are provided in the documents.

Windows Now Playing Session Manager Elevation of Privilege Vulnerability

Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally...

Windows Now Playing Session Manager Elevation of Privilege Vulnerability

Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally...

CVE-2026-89120

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests,...

CVE-2026-89120

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from the FLP . A low-privileged attacker could exploit this by sending specially crafted requests to bypass res...

CVE-2026-89120 Missing authorization check in SAP ABAP Platform

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests,...

EUVD-2026-98199

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests,...

PT-2026-112504

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A use-after-free issue in the Now Playing Session Manager allows an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption flaw that occurs when an applicati...

CVE-2026-83700: Use After Free

Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83701: Windows Now Playing Session Manager Elevation of Privilege Vulnerability

Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83700: Windows Now Playing Session Manager Elevation of Privilege Vulnerability

Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally...