Priority LOW 34
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol.
Vulnerabilities
176 records
Priority LOW 34
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol.
Priority LOW 29
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol.
Priority LOW 31
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol.
TI-2026-84872 CVE-2026-118628 · GHSA-vf3g-89fc-wcmp
Server-side request forgery in MLflow get-artifacts discloses data
Priority MEDIUM 42
MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability.
TI-2026-84871 CVE-2026-118627 · GHSA-j38m-78x9-f2gg
Deserialization flaw in MLflow load_explainer allows code execution
Priority LOW 35
MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability.
TI-2026-84870 CVE-2026-118626 · GHSA-5wwc-v2xc-r6fq
Missing authorization in MLflow lets users escalate privileges
Priority LOW 26
MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability.
TI-2026-84869 CVE-2026-118625 · GHSA-8j39-qjmw-r5p7
Missing authorization in MLflow Tracking Server allows escalation
Priority LOW 30
MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability.
TI-2026-84868 CVE-2026-118624 · GHSA-8hwc-xxhv-q57m
Missing authorization in MLflow Tracking Server Jobs discloses data
Priority LOW 24
MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability.
TI-2026-84867 CVE-2026-118623 · GHSA-88cv-457h-5c75
Untrusted pickle deserialization in MLflow enables code execution
Priority LOW 36
MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability.
TI-2026-82374 CVE-2026-119025 · GHSA-jgwm-4pmq-r4w4
OS command injection in open via PowerShell on Windows
Priority LOW 39
open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL.
TI-2026-81527 CVE-2026-116692 · GHSA-26p8-2jq9-3vq9
Code execution via scorer deserialization in MLflow servers
Priority HIGH 82
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.
TI-2026-81526 CVE-2026-116691 · GHSA-j7qq-vr8c-xvw3
MLflow CrewAI autologging stores LLM provider API keys in traces
Priority MEDIUM 62
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.
TI-2026-81523 CVE-2026-116690 · GHSA-m65p-9j7q-6w33
Arbitrary file read in MLflow via prompt model version source
Priority MEDIUM 42
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.
TI-2026-81517 CVE-2026-116686 · GHSA-rwrf-2pqf-9j8j
Python SDK for Model Context Protocol fetches server-chosen $ref URLs
Priority LOW 29
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients.
TI-2026-81516 CVE-2026-116685 · GHSA-5h93-6whr-6q8j
Model Context Protocol Python SDK sends credentials across redirects
Priority LOW 27
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients.
TI-2026-81515 CVE-2026-116684 · GHSA-w4fh-qvv9-3v23
Model Context Protocol Python SDK accepts tokens for other servers
Priority LOW 32
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients.
TI-2026-79999 CVE-2026-115886 · GHSA-2wqp-q3c6-ccj5
Server-side request forgery in MLflow scorer endpoints
Priority HIGH 68
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.
TI-2026-76998 CVE-2026-111767 · GHSA-22jm-h49p-29qw
Cross-session access to tasks in MCP TypeScript SDK
Priority MEDIUM 43
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients.
TI-2026-76541 CVE-2026-53995 · GHSA-wqmh-qccw-pqwf
Path traversal in MLflow trace ID API lets attackers write files
Priority HIGH 77
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal…
Priority MEDIUM 40
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients.
Priority MEDIUM 40
The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients.
TI-2026-74320 CVE-2026-59951 · GHSA-84m7-p3x7-pcfv
Unbounded sessions in MCP Python SDK StreamableHTTP transport
Priority LOW 37
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP).
TI-2026-70693 CVE-2026-108714 · GHSA-645v-p22p-m3jx
Uncontrolled memory allocation in MCP Kotlin SDK WebSockets
Priority MEDIUM 44
MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize…
Priority LOW 39
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients.