mcp vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-59950Highmcp: MCP Python SDK: WebSocket server transport does not support Host/Origin validation CVE-2026-52869Highmcp: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal CVE-2026-52870Highmcp: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks CVE-2026-33946Highmcp: MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay CVE-2025-66416Highmcp: Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default CVE-2025-53366Highmcp: MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS CVE-2025-53365Highmcp: MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo