P
Vendor security profile
protocol
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs2
Critical0
CISA KEV0
Public exploit1
Patch rate%50
Avg. CVSS6.7
12-month vulnerability rate
0
0
0
0
1
0
0
0
0
0
0
0
CVE KEV
CVE severity distribution
2toplam CVE
High1 (50%)
Medium1 (50%)
Patch and exploitation view
%50
Verified patch
%0
CISA KEV
%50
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
1Unknown
Latest vulnerabilities
8.7
CVE-2026-108714
MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket
M
Patch status unknown
7.5
CVE-2026-104850
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
M
Patch status unknownEPSS %0
6.9
CVE-2026-104120
modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery
M
Patch verifiedEPSS %0
5.3
CVE-2026-101101
ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception
A
Patch verifiedEPSS %0
5.3
CVE-2026-101100
ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup
A
Patch verifiedEPSS %0
5.3
CVE-2026-101099
ag-ui-protocol ag-ui Kotlin Community SDK SseParser.kt exceptional condition
A
Patch verifiedEPSS %1
5.3
CVE-2026-101098
ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption
A
Patch verifiedEPSS %1
2.3
CVE-2026-101061
utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass
U
Patch status unknownEPSS %0
8.4
CVE-2026-101060
python-utcp before 1.1.4 SSRF via unvalidated HTTP redirects
U
Patch status unknownEPSS %0
7.1
CVE-2026-101059
utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass
U
Patch status unknownEPSS %0