M
Vendor security profile
modelcontextprotocol
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs12
Critical0
CISA KEV0
Public exploit5
Patch rate%17
Avg. CVSS7.3
12-month vulnerability rate
0
0
0
1
0
0
0
0
0
1
4
6
CVE KEV
CVE severity distribution
12toplam CVE
High7 (58%)
Medium5 (42%)
Patch and exploitation view
%17
Verified patch
%0
CISA KEV
%42
Public exploit
2Patch available
0Partial
0Workaround
0Vendor: no patch
10Unknown
Latest vulnerabilities
7.5
CVE-2026-109527
Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies
M
Patch status unknownEPSS %1
7.5
CVE-2026-108395
Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies
M
Patch status unknownEPSS %1
6.9
CVE-2026-59951
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
M
Patch status unknownEPSS %0
8.7
CVE-2026-108714
MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket
M
Patch status unknownEPSS %0
7.5
CVE-2026-104850
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
M
Patch status unknownEPSS %0
6.9
CVE-2026-104120
modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery
M
Patch verifiedEPSS %0
6.8
CVE-2026-64684
RMCP: Custom HTTP headers leak to cross-origin redirect targets
M
Patch status unknownEPSS %1
8.2
CVE-2026-63127
RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery
M
Patch status unknownEPSS %0
7.5
CVE-2026-63128
RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service
M
Patch status unknownEPSS %1
6.2
CVE-2026-53937
MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)
M
Patch status unknownEPSS %0