Skip to content
@modelcontextprotocol vulnerabilities
Newest
-
@modelcontextprotocol server, modelcontextprotocol typescript-sdk +1 more
Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another
CVE-2026-111770
Public exploitFix available
7.7 High
-
@modelcontextprotocol sdk, server, modelcontextprotocol typescript-sdk +2 more
Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
CVE-2026-111768
Fix available
7.5 High
-
@clerk express, @modelcontextprotocol sdk, server +2 more +4 more
Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service
CVE-2026-111771
Fix available
6.8 Medium
-
@modelcontextprotocol client, sdk, modelcontextprotocol typescript-sdk +2 more
Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
CVE-2026-111769
Fix available
6.5 Medium