Skip to content
Samanhappy vulnerabilities
Newest
-
mcphub
samanhappy MCPHub passthroughHeaders.ts information disclosure
CVE-2026-120323
5.3 Medium
-
mcphub
samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management
CVE-2026-94047
5.3 Medium
-
mcphub
MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass
CVE-2026-90474
7.6 High
-
mcphub
MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration
CVE-2026-79744
8.8 High
-
mcphub
MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)
CVE-2026-79745
7.1 High
-
mcphub
MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching
CVE-2026-79746
8.1 High
-
mcphub
MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)
CVE-2026-79747
7.1 High
-
mcphub
MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)
CVE-2026-79748
9.9 Critical
-
mcphub
MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation
CVE-2026-79749
7.6 High
-
mcphub
MCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF)
CVE-2026-79750
7.7 High
-
mcphub
MCPHub: Path Traversal via Malicious MCPB Manifest Name
CVE-2026-79743
Fix available
6.9 Medium
-
mcphub
samanhappy MCPHub sseService.ts handleSseConnectionfunction improper authentication
CVE-2025-11287
6.9 Medium
-
mcphub
samanhappy MCPHub MCPRouter Service serverController.ts server-side request forgery
CVE-2025-11286
5.1 Medium
-
mcphub
samanhappy MCPHub serverController.ts os command injection
CVE-2025-11285
5.3 Medium