Known Vulnerabilities for Server-legacy by @modelcontextprotocol
Listed below are 10 of the newest known vulnerabilities associated with "Server-legacy" by "@modelcontextprotocol".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-120684 json | A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memor... | Not Provided | 2026-11-03 | 2026-11-03 |
| CVE-2026-118665 json | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL... | Not Provided | 2026-10-28 | 2026-11-03 |
| CVE-2026-118513 json | Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56... | Not Provided | 2026-11-04 | 2026-11-05 |
| CVE-2026-111771 json | The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol... | Not Provided | 2026-11-05 | 2026-11-05 |
| CVE-2026-105115 json | OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP inter... | Not Provided | 2026-10-03 | 2026-10-05 |
| CVE-2026-100705 json | Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.16... | Not Provided | 2026-09-26 | 2026-09-26 |
| CVE-2026-98451 json | In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish_no_open() for non-regular inodes... | Not Provided | 2026-10-18 | 2026-10-30 |
| CVE-2026-94419 json | Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of the for... | Not Provided | 2026-09-27 | 2026-09-29 |
| CVE-2026-92595 json | Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` ... | Not Provided | 2026-09-16 | 2026-09-19 |
| CVE-2026-92262 json | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, a... | Not Provided | 2026-10-16 | 2026-10-21 |