Advisories

Published advisories, each linked to its primary record.

This is an index. Every advisory below was published by the vendor, the CNA or the repository maintainer, not by Cognivators. Severity is as they rated it. Checked against the CVE Program API and the GitHub API on 22 October 2026.

CVE records

Two CVE records credit the founder as finder.

Both were assigned and published by the vendor's own CNA. Cognivators did not assign them.

CVE-2026-14540
Google · 2026-07-31
Server-side request forgery via unrestricted HTTP redirection in MCP Toolbox
8.0 High (CVSS 4.0, assigned by Google)
CVE record (cve.org)Fix, PR #3448
CVE-2026-97228
Rapid7 · 2026-09-25
GraphQL query injection in the export status lookup of Rapid7 Bulk Export MCP
2.7 Low (CVSS 3.1)
CVE record (cve.org)Fixed release v0.6.2

GitHub repository advisories

Seventeen published, with the founder's credit accepted.

These are repository security advisories. None is in the global GitHub Advisory Database and none has a CVE ID. Titles are shortened here; the link goes to the full text.

GHSA-f8rf-rcrx-h6r9
Critical · 2026-09-01
Host-header spoof bypasses an earlier management-route fix
datalayer/jupyter-mcp-server
Advisory
GHSA-m623-vm42-63fg
Critical · 2026-09-03
OS command injection through MCP server arguments in the install path
VeriTeknik/pluggedin-app
Advisory
GHSA-q3gg-rgxh-gh64
High · 2026-09-01
op_run passes the service-account token to subprocesses and model context
CakeRepository/1Password-MCP (community project)
Advisory
GHSA-mf4q-589h-8gwx
High · 2026-09-02
WinRM credentials exposed in the spawned PowerShell command line
IMRRD/powershell-mcp
Advisory
GHSA-wvxg-744g-6pcg
High · 2026-09-02
Shell allowlist and pattern blacklist both miss xargs, allowing unconfined command execution
vitali87/code-graph-rag
Advisory
GHSA-pw2j-pj4h-f5vg
High · 2026-09-03
SSRF protection rejects literal IPs but never resolves hostnames
INFOKOM-KI/Wazuh-MCP-Server
Advisory
GHSA-hpmc-4g74-v53v
High · 2026-09-05
SSRF in the direct video adapter, no allowlist on client-supplied URLs
guimatheus92/mcp-video-analyzer
Advisory
GHSA-mhj6-wq83-cqf5
High · 2026-09-25
Unauthenticated access in HTTP mode spends the operator's API key
CryptoAPIs-io/cryptoapis-mcp-hub
Advisory
GHSA-8f3c-j762-q9q4
High · 2026-10-05
Server-side file access, unauthenticated HTTP defaults and credential exposure over HTTP transports
galaxyproject/galaxy-mcp
Advisory
GHSA-7hwf-488h-59x8
Medium · 2026-09-03
OAuth server skips redirect_uri validation for unregistered client IDs, internal network only
navikt/copilot (joint credit with another finder)
Advisory
GHSA-7cc5-q98r-rjwj
Medium · 2026-09-03
Input-validation and output-escaping gaps in the quote and booking tools
warpfreight/warp-agent-mcp
Advisory
GHSA-93f9-v357-x7m7
Medium · 2026-09-14
Unauthenticated SSRF through a caller-supplied repo_url
ark-forge/mcp-eu-ai-act
Advisory
GHSA-gprw-26jj-cjfq
Medium · 2026-09-15
Reflected XSS in the docs page through unescaped forwarded headers
timescale/mcp-boilerplate-node
Advisory
GHSA-5r2f-7788-qp8v
Medium · 2026-09-20
SSRF guard bypassable through DNS rebinding
SylphxAI/anymd (formerly pdf-reader-mcp)
Advisory
GHSA-f6c5-f2ph-7x7p
Medium · 2026-09-22
In hosted mode, MCP session IDs are never bound to the authenticated caller
Repliers-io/mcp-server
Advisory
GHSA-cwcq-65mg-v26r
Medium · 2026-09-25
Ungated Steam Partner API write tools in the default server binary
TMHSDigital/steam-mcp
Advisory
GHSA-6mr5-wx6p-65fg
Medium · 2026-09-30
MCP read-only and confirmation gates allow privileged database server file operations
clidey/whodb
Advisory

Scope of this page

What is not listed.

Fixes that vendors merged are on the research page. Anything still in coordinated disclosure is not described until the vendor publishes. Cognivators has not assigned any CVE IDs. This page will list advisories Cognivators publishes itself if it is approved as a CNA.

Disclosure policy