Known Vulnerabilities for Server by @modelcontextprotocol
Listed below are 10 of the newest known vulnerabilities associated with "Server" by "@modelcontextprotocol".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-124040 json | CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2... | Not Provided | 2026-11-06 | 2026-11-06 |
| CVE-2026-123993 json | Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability where a QA build of the G... | Not Provided | 2026-11-06 | 2026-11-06 |
| CVE-2026-123858 json | In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted proje... | Not Provided | 2026-11-06 | 2026-11-06 |
| CVE-2026-123856 json | In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server | Not Provided | 2026-11-06 | 2026-11-06 |
| CVE-2026-123848 json | In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates | Not Provided | 2026-11-06 | 2026-11-06 |
| CVE-2026-123824 json | The Symfony Config component XmlUtils::parse() enables DTD validation before rejecting documents that carry a doctype, allo... | Not Provided | 2026-11-06 | 2026-11-06 |
| CVE-2026-123786 json | Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit r... | Not Provided | 2026-11-06 | 2026-11-06 |
| CVE-2026-123783 json | Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstruct... | Not Provided | 2026-11-06 | 2026-11-06 |
| CVE-2026-123660 json | In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out o... | Not Provided | 2026-11-06 | 2026-11-06 |
| CVE-2026-123619 json | Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows ... | Not Provided | 2026-11-06 | 2026-11-06 |