Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
937 results · page 12 of 19
May 5, 2026A vulnerability was found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8.CVE-2026-7812 · Other software · 54yyyu · reported by VulDBMedium 5.5
A vulnerability was found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8. The impacted element is the function git_operation of the file src/code_mcp/server.py of the component MCP Tool. Performing a manipulation of the argument operation results in command injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- code-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026A vulnerability has been found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8.CVE-2026-7811 · Other software · 54yyyu · reported by VulDBMedium 5.5
A vulnerability has been found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8. The affected element is the function is_safe_path of the file src/code_mcp/server.py of the component MCP File Handler. Such manipulation leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- code-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2.CVE-2026-7810 · Other software · UsamaK98 · reported by VulDBMedium 5.5
A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function create_notebook/read_notebook/edit_cell/add_cell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- python-notebook-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026Vulnerability in the Oracle MCP Server Helper Tool product of Oracle Open Source Projects (component: helper tool).CVE-2026-35228 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.7
Vulnerability in the Oracle MCP Server Helper Tool product of Oracle Open Source Projects (component: helper tool). The supported versions that is affected is 1.0.1-1.0.156. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle MCP Server Helper Tool. Successful attacks of this vulnerability can result in Oracle MCP Server Helper Tool executing malicious SQL.
- Product
- Oracle MCP Server Helper Tool product of Oracle Open Source Projects
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026A security flaw has been discovered in Axle-Bucamp MCP-Docusaurus up to 404bc028e15ec304c9a045528560f4b5f27a17e0.CVE-2026-7788 · Other software · Axle-Bucamp · reported by VulDBMedium 5.5
A security flaw has been discovered in Axle-Bucamp MCP-Docusaurus up to 404bc028e15ec304c9a045528560f4b5f27a17e0. The affected element is the function update_document/continue_document/delete_document/get_content of the file app/routes/document.py. Performing a manipulation of the argument DOCS_DIR/path results in path traversal. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- MCP-Docusaurus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026A security flaw has been discovered in A-G-U-P-T-A wireshark-mcp edaf604416fbc94a201b4043092d4a1b09a12275/400c3da70074f22f3cce7ccb65304cafc7089c89.CVE-2026-7785 · Other software · A-G-U-P-T-A · reported by VulDBMedium 5.5
A security flaw has been discovered in A-G-U-P-T-A wireshark-mcp edaf604416fbc94a201b4043092d4a1b09a12275/400c3da70074f22f3cce7ccb65304cafc7089c89. This affects the function quick_capture of the file pyshark_mcp.py. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- wireshark-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026A security flaw has been discovered in puchunjie doc-tools-mcp 1.0.18.CVE-2026-7738 · Other software · puchunjie · reported by VulDBLow 2.1
A security flaw has been discovered in puchunjie doc-tools-mcp 1.0.18. This affects the function create_document/open_document of the file src/mcp-server.ts of the component MCP Interface. The manipulation of the argument filePath results in path traversal. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- doc-tools-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.CVE-2026-43859 · Other software · mutt · reported by MITRELow 3.7
mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.
- Product
- mutt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026A weakness has been identified in privsim mcp-test-runner 0.2.0.CVE-2026-7730 · Other software · privsim · reported by VulDBLow 2.1
A weakness has been identified in privsim mcp-test-runner 0.2.0. Impacted is the function child_process.spawn of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- mcp-test-runner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026A security flaw has been discovered in pixelsock directus-mcp 1.0.0.CVE-2026-7729 · Other software · pixelsock · reported by VulDBLow 2.1
A security flaw has been discovered in pixelsock directus-mcp 1.0.0. This issue affects the function validateUrl of the file index.ts of the component MCP Interface. Performing a manipulation of the argument fileUrl results in server-side request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
- Product
- directus-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026A vulnerability was identified in ryanjoachim mcp-rtfm 0.1.0.CVE-2026-7728 · Other software · ryanjoachim · reported by VulDBLow 2.1
A vulnerability was identified in ryanjoachim mcp-rtfm 0.1.0. This vulnerability affects the function get_doc_content/read_doc/update_doc of the component MCP Interface. Such manipulation of the argument docFile leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e6f0686fc36012f78236e7fed172c81444904b0b. It is best practice to apply a patch to resolve this issue.
- Product
- mcp-rtfm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2026A vulnerability has been found in ravenwits mcp-server-arangodb up to 0.4.7.CVE-2026-7715 · Other software · ravenwits · reported by VulDBLow 2.1
A vulnerability has been found in ravenwits mcp-server-arangodb up to 0.4.7. This affects the function arango_backup of the file src/tools.ts of the component MCP Interface. Such manipulation of the argument outputDir leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- mcp-server-arangodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2026A security flaw has been discovered in r-huijts mcp-server-rijksmuseum up to 1.0.4.CVE-2026-7653 · Other software · r-huijts · reported by VulDBLow 2.1
A security flaw has been discovered in r-huijts mcp-server-rijksmuseum up to 1.0.4. Affected is the function open_image_in_browser of the file src/index.ts of the component MCP Interface. Performing a manipulation of the argument imageUrl results in os command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- mcp-server-rijksmuseum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2026A vulnerability was detected in crazyrabbitLTC mcp-code-review-server up to 0.1.0.CVE-2026-7628 · Other software · crazyrabbitLTC · reported by VulDBLow 2.1
A vulnerability was detected in crazyrabbitLTC mcp-code-review-server up to 0.1.0. This issue affects the function executeRepomix of the file src/repomix.ts of the component RepoMix Command Handler. Performing a manipulation results in command injection. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
- Product
- mcp-code-review-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2026A security vulnerability has been detected in 8nite metatrader-4-mcp 1.0.0.CVE-2026-7627 · Other software · 8nite · reported by VulDBLow 2.1
A security vulnerability has been detected in 8nite metatrader-4-mcp 1.0.0. This vulnerability affects the function CallToolRequestSchema of the file src/index.ts of the component sync_ea_from_file. Such manipulation of the argument ea_name leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- metatrader-4-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2.CVE-2026-7600 · Other software · ArtMin96 · reported by VulDBLow 2.1
A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. This impacts the function yii_command_help/yii_execute_command of the file src/index.ts of the component MCP Interface. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- yii2-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026A vulnerability was detected in Dayoooun hwpx-mcp 0.2.0.CVE-2026-7599 · Other software · Dayoooun · reported by VulDBLow 2.1
A vulnerability was detected in Dayoooun hwpx-mcp 0.2.0. This affects the function save_document/export_to_text/export_to_html of the file mcp-server/src/index.ts of the component MCP Interface. Performing a manipulation of the argument output_path results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- hwpx-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026A vulnerability was detected in Flux159 mcp-game-asset-gen 0.1.0.CVE-2026-7594 · Other software · Flux159 · reported by VulDBMedium 5.5
A vulnerability was detected in Flux159 mcp-game-asset-gen 0.1.0. Affected is the function image_to_3d_async of the file src/index.ts of the component MCP Interface. The manipulation of the argument statusFile results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- mcp-game-asset-gen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026A security vulnerability has been detected in Sunwood-ai-labs command-executor-mcp-server up to 0.1.0.CVE-2026-7593 · Other software · Sunwood-ai-labs · reported by VulDBMedium 5.5
A security vulnerability has been detected in Sunwood-ai-labs command-executor-mcp-server up to 0.1.0. This impacts the function execute_command of the file src/index.ts of the component MCP Interface. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- command-executor-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026A security flaw has been discovered in TimBroddin astro-mcp-server up to 1.1.1.CVE-2026-7591 · Other software · TimBroddin · reported by VulDBLow 2.1
A security flaw has been discovered in TimBroddin astro-mcp-server up to 1.1.1. The impacted element is an unknown function of the file src/index.ts of the component MCP Tool Query Construction. Performing a manipulation of the argument request.params.arguments results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- astro-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026A vulnerability was identified in eyal-gor p_69_branch_monkey_mcp up to 69bc71874ce40050ef45fde5a435855f18af3373.CVE-2026-7590 · Other software · eyal-gor · reported by VulDBMedium 5.5
A vulnerability was identified in eyal-gor p_69_branch_monkey_mcp up to 69bc71874ce40050ef45fde5a435855f18af3373. The affected element is an unknown function of the file branch_monkey_mcp/bridge_and_local_actions/routes/advanced.py of the component Preview Endpoint. Such manipulation of the argument dev_script leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- p_69_branch_monkey_mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026A vulnerability was determined in ghantakiran splunk-mcp-integration up to 0b86b09d5e5adf0433acd43c975951224613a1a6.CVE-2026-7589 · Other software · ghantakiran · reported by VulDBMedium 5.5
A vulnerability was determined in ghantakiran splunk-mcp-integration up to 0b86b09d5e5adf0433acd43c975951224613a1a6. Impacted is the function create_csv_export of the file services/csv-export-service/app/api/v1/endpoints/csv_export.py of the component CSV Export. This manipulation of the argument job_name causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- splunk-mcp-integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026A vulnerability was found in ggerve coding-standards-mcp.CVE-2026-7588 · Other software · ggerve · reported by VulDBMedium 5.5
A vulnerability was found in ggerve coding-standards-mcp. This issue affects the function get_style_guide/get_best_practices of the file server.py. The manipulation of the argument Language results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- coding-standards-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026In the Linux kernel, the following vulnerability has been resolved: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy Buffer size used in dma allocation CVE-2026-31743 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy Buffer size used in dma allocation and memcpy is wrong. It can lead to undersized DMA buffer access and possible memory corruption. use correct buffer size in dma_alloc_coherent and memcpy.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 29, 2026A vulnerability was detected in VetCoders mcp-server-semgrep 1.0.0.CVE-2026-7446 · Other software · VetCoders · reported by VulDBMedium 5.5
A vulnerability was detected in VetCoders mcp-server-semgrep 1.0.0. This affects the function analyze_results/filter_results/export_results/compare_results/scan_directory/create_rule of the file src/index.ts of the component MCP Interface. The manipulation of the argument ID results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 1.0.1 is able to mitigate this issue. The patch is identified as 141335da044e53c3f5b315e0386e01238405b771. It is advisable to upgrade the affected component.
- Product
- mcp-server-semgrep
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026A security vulnerability has been detected in ZachHandley ZMCPTools up to 0.2.2.CVE-2026-7445 · Other software · ZachHandley · reported by VulDBLow 2.1
A security vulnerability has been detected in ZachHandley ZMCPTools up to 0.2.2. Affected by this issue is some unknown functionality of the file src/managers/ResourceManager.ts of the component MCP Log Resource Handler. The manipulation of the argument dirname leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- ZMCPTools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026A weakness has been identified in BurtTheCoder mcp-dnstwist up to 1.0.4.CVE-2026-7443 · Other software · BurtTheCoder · reported by VulDBMedium 5.5
A weakness has been identified in BurtTheCoder mcp-dnstwist up to 1.0.4. Affected by this vulnerability is the function fuzz_domain of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument Request can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- mcp-dnstwist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026A vulnerability was found in Algovate xhs-mcp 0.8.11.CVE-2026-7417 · Other software · Algovate · reported by VulDBMedium 5.5
A vulnerability was found in Algovate xhs-mcp 0.8.11. This affects the function xhs_publish_content of the file src/server/mcp.server.ts of the component MCP Interface. Performing a manipulation of the argument media_paths results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- xhs-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026A vulnerability was found in PolarVista xcode-mcp-server 1.0.0.CVE-2026-7416 · Other software · PolarVista · reported by VulDBMedium 5.5
A vulnerability was found in PolarVista xcode-mcp-server 1.0.0. This issue affects the function build_project/run_tests of the file src/index.ts of the component MCP Interface. The manipulation of the argument Request results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- xcode-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026A weakness has been identified in getsimpletool mcpo-simple-server up to 0.2.0.CVE-2026-7404 · Other software · getsimpletool · reported by VulDBMedium 5.5
A weakness has been identified in getsimpletool mcpo-simple-server up to 0.2.0. Affected is the function delete_shared_prompt of the file src/mcpo_simple_server/services/prompt_manager/base_manager.py. This manipulation of the argument detail causes relative path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- mcpo-simple-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026A security flaw has been discovered in geldata gel-mcp 0.1.0.CVE-2026-7403 · Other software · geldata · reported by VulDBMedium 5.5
A security flaw has been discovered in geldata gel-mcp 0.1.0. This impacts the function list_rules/fetch_rule of the file src/gel_mcp/server.py. The manipulation of the argument rule_name results in path traversal. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- gel-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026A security vulnerability has been detected in geekgod382 filesystem-mcp-server 1.0.0.CVE-2026-7400 · Other software · geekgod382 · reported by VulDBMedium 5.5
A security vulnerability has been detected in geekgod382 filesystem-mcp-server 1.0.0. This issue affects the function is_path_allowed of the file server.py of the component read_file_tool/write_file_tool. Such manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.1.0 is capable of addressing this issue. The name of the patch is 45364545fc60dc80aadcd4379f08042d3d3d292e. Upgrading the affected component is advised.
- Product
- filesystem-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026A weakness has been identified in florensiawidjaja BioinfoMCP up to 7ada7918b9e515604d3c0ae264d3a9af10bf6e54.CVE-2026-7398 · Other software · florensiawidjaja · reported by VulDBMedium 5.5
A weakness has been identified in florensiawidjaja BioinfoMCP up to 7ada7918b9e515604d3c0ae264d3a9af10bf6e54. This vulnerability affects the function Upload of the file bioinfo_mcp_platform/app.py of the component Upload Endpoint. This manipulation of the argument Name causes path traversal. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- BioinfoMCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026A flaw has been found in fatbobman mail-mcp-bridge up to 1.3.3.CVE-2026-7386 · Other software · fatbobman · reported by VulDBMedium 5.5
A flaw has been found in fatbobman mail-mcp-bridge up to 1.3.3. Affected is an unknown function of the file src/mail_mcp_server.py. Executing a manipulation of the argument message_ids can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 1.3.4 is able to address this issue. This patch is called 638b162b26532e32fa8d8047f638537dbdfe197a. Upgrading the affected component is recommended.
- Product
- mail-mcp-bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026A vulnerability was detected in ezequiroga mcp-bases 357ca19c7a49a9b9cb2ef639b366f03aba8bea39/c630b8ab0f970614d42da8e566e9c0d15a16414c.CVE-2026-7384 · Other software · ezequiroga · reported by VulDBMedium 5.5
A vulnerability was detected in ezequiroga mcp-bases 357ca19c7a49a9b9cb2ef639b366f03aba8bea39/c630b8ab0f970614d42da8e566e9c0d15a16414c. This impacts the function search_papers of the file research_server.py. Performing a manipulation of the argument topic results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- mcp-bases
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026A flaw has been found in elinsky execution-system-mcp 0.1.0.CVE-2026-7319 · Other software · elinsky · reported by VulDBMedium 5.5
A flaw has been found in elinsky execution-system-mcp 0.1.0. The impacted element is the function _get_context_file_path of the file src/execution_system_mcp/server.py of the component add_action Tool. This manipulation of the argument context causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used.
- Product
- execution-system-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026A vulnerability was detected in elie mcp-project 0.1.0.CVE-2026-7318 · Other software · elie · reported by VulDBLow 2
A vulnerability was detected in elie mcp-project 0.1.0. The affected element is the function search_papers of the file research_server.py. The manipulation of the argument topic results in path traversal. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- mcp-project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026A vulnerability has been found in eiliyaabedini aider-mcp up to 667b914301aada695aab0e46d1fb3a7d5e32c8af.CVE-2026-7316 · Other software · eiliyaabedini · reported by VulDBMedium 5.5
A vulnerability has been found in eiliyaabedini aider-mcp up to 667b914301aada695aab0e46d1fb3a7d5e32c8af. Affected is an unknown function of the file aider_mcp.py of the component code_with_ai. The manipulation of the argument working_dir/editable_files leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- aider-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026A flaw has been found in eiceblue spire-pdf-mcp-server 0.1.1.CVE-2026-7315 · Other software · eiceblue · reported by VulDBMedium 5.5
A flaw has been found in eiceblue spire-pdf-mcp-server 0.1.1. This impacts the function get_pdf_path of the file src/spire_pdf_mcp/server.py of the component PDF File Handler. Executing a manipulation of the argument filepath can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- spire-pdf-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026A vulnerability was detected in eiceblue spire-doc-mcp-server 1.0.0.CVE-2026-7314 · Other software · eiceblue · reported by VulDBMedium 5.5
A vulnerability was detected in eiceblue spire-doc-mcp-server 1.0.0. This affects the function get_doc_path of the file src/spire_doc_mcp/api/base.py. Performing a manipulation of the argument document_name results in path traversal. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- spire-doc-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026A flaw has been found in WilliamCloudQi matlab-mcp-server up to ab88f6b9bf5f36f725e8628029f7f6dd0d9913ca.CVE-2026-7272 · Other software · WilliamCloudQi · reported by VulDBMedium 5.5
A flaw has been found in WilliamCloudQi matlab-mcp-server up to ab88f6b9bf5f36f725e8628029f7f6dd0d9913ca. The affected element is the function generate_matlab_code/execute_matlab_code of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument scriptPath can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- matlab-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026A vulnerability was detected in AgiFlow scaffold-mcp up to 1.0.27.CVE-2026-7237 · Other software · AgiFlow · reported by VulDBMedium 5.5
A vulnerability was detected in AgiFlow scaffold-mcp up to 1.0.27. Affected by this issue is some unknown functionality of the file packages/scaffold-mcp/src/server/index.ts of the component write-to-file Tool. The manipulation of the argument file_path results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.1.0 can resolve this issue. The patch is identified as c4d23592ae5fb59cfeefc4641e6826f8ac89b9c6. You should upgrade the affected component.
- Product
- scaffold-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026A vulnerability was found in TencentCloudBase CloudBase-MCP up to 2.17.0.CVE-2026-7221 · Other software · TencentCloudBase · reported by VulDBMedium 5.5
A vulnerability was found in TencentCloudBase CloudBase-MCP up to 2.17.0. Affected is the function openUrl of the file mcp/src/interactive-server.ts of the component open-url API Endpoint. The manipulation of the argument req.body.url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2.17.1 is able to address this issue. The patch is identified as 3f678a1e7bd400cd76469d61024097d4920dc6b5. It is recommended to upgrade the affected component.
- Product
- CloudBase-MCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026A vulnerability has been found in jackwrichards FastlyMCP up to 6f3d0b0e654fc51076badc7fa16c03c461f95620.CVE-2026-7220 · Other software · jackwrichards · reported by VulDBMedium 5.5
A vulnerability has been found in jackwrichards FastlyMCP up to 6f3d0b0e654fc51076badc7fa16c03c461f95620. This impacts an unknown function of the file fastly-mcp.mjs of the component fastly_cli Tool. The manipulation of the argument command leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- FastlyMCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026A weakness has been identified in donchelo processing-claude-mcp-bridge up to e017b20a4b592a45531a6392f494007f04e661bd.CVE-2026-7216 · Other software · donchelo · reported by VulDBMedium 5.5
A weakness has been identified in donchelo processing-claude-mcp-bridge up to e017b20a4b592a45531a6392f494007f04e661bd. Impacted is an unknown function of the file processing_server.py of the component create_sketch Tool. This manipulation of the argument sketch_name causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- processing-claude-mcp-bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026A security flaw has been discovered in egtai gmx-vmd-mcp up to 0.1.0.CVE-2026-7215 · Other software · egtai · reported by VulDBMedium 5.5
A security flaw has been discovered in egtai gmx-vmd-mcp up to 0.1.0. This issue affects the function launch_vmd_gui_tool of the file mcp_server.py of the component VMD Launch Handler. The manipulation of the argument structure_file/trajectory_file results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- gmx-vmd-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026A vulnerability was detected in ef10007 MLOps_MCP 1.0.0.CVE-2026-7213 · Other software · ef10007 · reported by VulDBMedium 5.5
A vulnerability was detected in ef10007 MLOps_MCP 1.0.0. This impacts an unknown function of the file fastmcp_server.py of the component save_file Tool. The manipulation of the argument filename/destination results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- MLOps_MCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026A security vulnerability has been detected in edvardlindelof notes-mcp up to 0.1.4.CVE-2026-7212 · Other software · edvardlindelof · reported by VulDBMedium 5.5
A security vulnerability has been detected in edvardlindelof notes-mcp up to 0.1.4. This affects an unknown function of the file notes_mcp.py. The manipulation of the argument root_dir/path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- notes-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026A weakness has been identified in dvladimirov MCP up to 0.1.0.CVE-2026-7211 · Other software · dvladimirov · reported by VulDBMedium 5.5
A weakness has been identified in dvladimirov MCP up to 0.1.0. The impacted element is the function GitSearchRequest of the file mcp_server.py of the component Git Search API. Executing a manipulation of the argument repo_url/pattern can lead to command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- MCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026A security flaw has been discovered in dubydu sqlite-mcp up to 0.1.0.CVE-2026-7206 · Other software · dubydu · reported by VulDBMedium 5.5
A security flaw has been discovered in dubydu sqlite-mcp up to 0.1.0. The affected element is the function extract_to_json of the file src/entry.py. Performing a manipulation of the argument output_filename results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The patch is named a5580cb992f4f6c308c9ffe6442b2e76709db548. Applying a patch is the recommended action to fix this issue.
- Product
- sqlite-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.