Known Vulnerabilities for Github-mcp-server by Github
Listed below are 10 of the newest known vulnerabilities associated with "Github-mcp-server" by "Github".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-81100 json | tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/http... | Not Provided | 2026-08-27 | 2026-08-29 |
| CVE-2026-79775 json | rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archiv... | Not Provided | 2026-08-25 | 2026-08-29 |
| CVE-2026-78147 json | A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the fil... | Not Provided | 2026-08-23 | 2026-08-27 |
| CVE-2026-76851 json | A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execut... | Not Provided | 2026-09-01 | 2026-09-02 |
| CVE-2026-72871 json | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the unauthenticated /api/providers/github/se... | Not Provided | 2026-08-10 | 2026-08-10 |
| CVE-2026-72867 json | Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-456... | Not Provided | 2026-08-10 | 2026-08-13 |
| CVE-2026-71365 json | A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitH... | Not Provided | 2026-08-18 | 2026-08-25 |
| CVE-2026-63044 json | Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can ca... | Not Provided | 2026-08-20 | 2026-08-21 |
| CVE-2026-56422 json | Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (id) an... | Not Provided | 2026-06-22 | 2026-06-22 |
| CVE-2026-55173 json | WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the f... | Not Provided | 2026-07-16 | 2026-07-17 |