1mcp-app @1mcp/agent vulnerabilities

• 1mcp-app @1mcp/agent 1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter CVE-2026-108586 5.3 MediumOctober 10, 2026