Vendor
modelcontextprotocol
53 known vulnerabilities.
Products
python-sdk 11
typescript-sdk 8
ruby-sdk 6
servers 6
registry 5
rust-sdk 4
inspector 3
server 3
sdk 3
go-sdk 3
java-sdk 2
kotlin-sdk 1
mcp-server-fetch 1
mcp-server-everything 1
io.modelcontextprotocol:kotlin-sdk 1
io.modelcontextprotocol:kotlin-sdk-client 1
io.modelcontextprotocol:kotlin-sdk-core 1
io.modelcontextprotocol:kotlin-sdk-server 1
php-sdk 1
io.modelcontextprotocol.sdk:mcp 1
io.modelcontextprotocol.sdk:mcp-core 1
client 1
express 1
server-legacy 1
2 results · Clear filters · Feed
-
Low 2.1
MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being target…
-
Low 3.5
MCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claims
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their i…