Vulnerabilidades en modelcontextprotocol
53 resultadosCVE-2025-49596CRITICALMCP Inspector proxy server lacks authentication between the Inspector client and proxyEPSS 44.5%CVE-2025-53366HIGHMCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of ServiceEPSS 9.8%CVE-2025-68143MEDIUMmcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locationsEPSS 8.1%CVE-2025-68144MEDIUMmcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local filesEPSS 7.2%CVE-2025-68145MEDIUMmcp-server-git has missing path validation when using --repository flagEPSS 7.0%CVE-2026-119025HIGHopen 7.2.0 before 11.0.0 OS Command Injection via PowerShell on WindowsEPSS 1.4%CVE-2026-67432HIGHMCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransportEPSS 0.8%CVE-2025-53109HIGHModel Context Protocol Servers Vulnerable to Path Validation Bypass via Prefix Matching and Symlink HandlingEPSS 0.8%CVE-2025-58444HIGHMCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP ServerEPSS 0.7%CVE-2026-109527HIGHModel Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodiesEPSS 0.7%CVE-2026-53965MEDIUMMCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of serviceEPSS 0.6%CVE-2026-108395HIGHModel Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodiesEPSS 0.6%CVE-2026-111768HIGHModel Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationEPSS 0.6%CVE-2025-53110HIGHModel Context Protocol Servers Vulnerable to Path Validation Bypass via Colliding Path PrefixEPSS 0.6%CVE-2025-66414HIGHDNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on LocalhostEPSS 0.5%CVE-2025-66416HIGHDNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on LocalhostEPSS 0.5%CVE-2026-111771MEDIUMModel Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another serviceEPSS 0.5%CVE-2026-63128HIGHRMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-serviceEPSS 0.5%CVE-2026-52869HIGHMCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalEPSS 0.5%CVE-2026-64684MEDIUMRMCP: Custom HTTP headers leak to cross-origin redirect targetsEPSS 0.5%