M
Vendor security profile
modelcontextprotocol
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs9
Critical0
CISA KEV0
Public exploit5
Patch rate%22
Avg. CVSS7.3
12-month vulnerability rate
0
0
0
1
0
0
0
0
0
1
4
3
CVE KEV
CVE severity distribution
9toplam CVE
High5 (56%)
Medium4 (44%)
Patch and exploitation view
%22
Verified patch
%0
CISA KEV
%56
Public exploit
2Patch available
0Partial
0Workaround
0Vendor: no patch
7Unknown
Latest vulnerabilities
8.7
CVE-2026-108714
MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket
M
Patch status unknown
7.5
CVE-2026-104850
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
M
Patch status unknownEPSS %0
6.9
CVE-2026-104120
modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery
M
Patch verifiedEPSS %0
6.8
CVE-2026-64684
RMCP: Custom HTTP headers leak to cross-origin redirect targets
M
Patch status unknownEPSS %1
8.2
CVE-2026-63127
RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery
M
Patch status unknownEPSS %0
7.5
CVE-2026-63128
RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service
M
Patch status unknownEPSS %1
6.2
CVE-2026-53937
MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)
M
Patch status unknownEPSS %0
6.9
CVE-2026-53965
MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of service
M
Patch status unknownEPSS %1
7.0
CVE-2026-27896
MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity
M
Patch verifiedEPSS %0