{
"version": "1.0.2",
"updated_at": "2026-07-01T12:03:36Z",
"entries": [
{
"id": "CVE-2026-55607",
"title": "Claude Code is an agentic coding tool",
"description": "Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named \".git\" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such as .zshenv), leading to code execution outside of seatbelt sandbox restrictions. Reliably exploiting this required the user to clone a malicious repository containing prompt injection content and run Claude Code against it. This vulnerability is fixed in 2.1.163.",
"severity": "high",
"affected_products": [
{
"vendor": "anthropic",
"product": "claude_code",
"version_affected": "< 2.1.163",
"version_fixed": "2.1.163"
}
],
"cwe_ids": [
"CWE-59",
"CWE-22",
"CWE-78"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-55607",
"https://github.com/anthropics/claude-code/security/advisories/GHSA-7835-87q9-rgvv"
],
"published_at": "2026-06-29T15:16:41.597",
"cvss_score": 8.8
},
{
"id": "CVE-2026-46406",
"title": "Claude Code is an agentic coding tool",
"description": "Claude Code is an agentic coding tool. From 2.1.59 until 2.1.128, the Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness, or symlink protection. The file was created world-readable (0644) in a world-traversable directory (0755), allowing any local user to read a privileged user's Claude response, which could contain secrets or credentials. Additionally, because the path was static and predictable, a local attacker could pre-create the directory and plant a symlink at the expected file path, causing the privileged process to follow the symlink and overwrite an attacker-chosen file with the response text. Exploiting this required a local unprivileged user on the same system and a privileged user to run the /copy command. This vulnerability is fixed in 2.1.128.",
"severity": "medium",
"affected_products": [
{
"vendor": "anthropic",
"product": "claude_code",
"version_affected": "< 2.1.128",
"version_fixed": "2.1.128"
}
],
"cwe_ids": [
"CWE-59",
"CWE-200",
"CWE-377"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-46406",
"https://github.com/anthropics/claude-code/security/advisories/GHSA-4vp2-6q8c-pvq2"
],
"published_at": "2026-06-29T15:16:41.033",
"cvss_score": 6.1
},
{
"id": "CVE-2026-50548",
"title": "Cursor is a code editor built for programming with AI",
"description": "Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write access to the command's working directory. A flaw was identified in how the agent could modify the working_directory parameter, which could cause the sandbox to include writable paths outside the intended workspace. A malicious agent could set working_directory to a sensitive location and write arbitrary files outside the workspace under the user's privileges. This enables non-sandboxed Remote Code Execution \u2014 for example by overwriting the cursorsandbox helper so later commands run unsandboxed \u2014 with no user interaction beyond a benign prompt. This vulnerability is fixed in 3.0.",
"severity": "critical",
"affected_products": [
{
"vendor": "anysphere",
"product": "cursor",
"version_affected": "< 3.0",
"version_fixed": "3.0"
}
],
"cwe_ids": [
"CWE-22"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-50548",
"https://github.com/cursor/cursor/security/advisories/GHSA-3p48-7v9f-v5cw"
],
"published_at": "2026-06-25T19:16:39.660",
"cvss_score": 9.8
},
{
"id": "CVE-2026-54316",
"title": "Claude Code is an agentic coding tool",
"description": "Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain\u2014including attacker-controlled model repositories\u2014was auto-approved without a permission prompt or being subject to --allowedTools restrictions. An attacker able to inject untrusted content into a Claude Code context could direct it to issue WebFetch requests against attacker-controlled repository files (e.g. /resolve/main/config.json), which HuggingFace counts as downloads server-side, creating a covert out-of-band channel for encoding and exfiltrating data Claude can access such as files, environment variables, or command output. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This vulnerability is fixed in 2.1.163.",
"severity": "critical",
"affected_products": [
{
"vendor": "anthropic",
"product": "claude_code",
"version_affected": "< 2.1.163",
"version_fixed": "2.1.163"
}
],
"cwe_ids": [
"CWE-183",
"CWE-515",
"CWE-200"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-54316",
"https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm"
],
"published_at": "2026-06-23T18:18:08.623",
"cvss_score": 9.1
},
{
"id": "CVE-2025-66389",
"title": "GitHub Copilot 1",
"description": "GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection.",
"severity": "high",
"affected_products": [
{
"vendor": "microsoft",
"product": "github_copilot",
"version_affected": "*",
"version_fixed": null
}
],
"cwe_ids": [
"CWE-552"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2025-66389",
"https://blindcyber.com/2025/10/28/copilot-fun/",
"https://github.com/microsoft/vscode-copilot-chat/",
"https://github.com/microsoft/vscode/blob/03baef1008086ed4960042fa463e570072173bb5/src/vs/workbench/contrib/chat/electron-browser/tools/fetchPageTool.ts#L152"
],
"published_at": "2026-06-22T14:16:24.073",
"cvss_score": 7.5
},
{
"id": "CVE-2026-50519",
"title": "Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code al...",
"description": "Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.",
"severity": "medium",
"affected_products": [
{
"vendor": "microsoft",
"product": "github_copilot_chat",
"version_affected": "< 1.123.2",
"version_fixed": "1.123.2"
}
],
"cwe_ids": [
"CWE-1188"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-50519",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50519"
],
"published_at": "2026-06-19T21:17:02.260",
"cvss_score": 6.5
},
{
"id": "CVE-2026-45482",
"title": "Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code al...",
"description": "Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.",
"severity": "high",
"affected_products": [
{
"vendor": "microsoft",
"product": "visual_studio_code",
"version_affected": "< 1.123.2",
"version_fixed": "1.123.2"
}
],
"cwe_ids": [
"CWE-22"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-45482",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45482"
],
"published_at": "2026-06-09T17:17:22.587",
"cvss_score": 8.4
},
{
"id": "CVE-2026-45609",
"title": "mcp-security provides Security and Authorization support for Model Context Protocol in Spring AI",
"description": "mcp-security provides Security and Authorization support for Model Context Protocol in Spring AI. Prior to 0.1.9, the mcp-security framework fails to implement the mandatory SSRF mitigations outlined in the Model Context Protocol (MCP) security specifications. Specifically, it processes untrusted URLs for OAuth-related discovery and metadata without verifying if the targets are malicious or internal to the network. This only affects installations with Dynamic Client Registration (DCR) enabled This vulnerability is fixed in 0.1.9.",
"severity": "high",
"affected_products": [
{
"vendor": "springaicommunity",
"product": "mcp_security",
"version_affected": "< 0.1.9",
"version_fixed": "0.1.9"
}
],
"cwe_ids": [
"CWE-918"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-45609",
"https://github.com/spring-ai-community/mcp-security/security/advisories/GHSA-qjp4-4jvr-xqg3"
],
"published_at": "2026-05-29T15:16:23.463",
"cvss_score": 7.2
},
{
"id": "CVE-2026-45136",
"title": "claude-code-cache-fix is a cache optimization proxy for Claude Code",
"description": "claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh (introduced in v3.5.0) interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of the payload closes the literal early and lets following bytes execute as Python in the user's Claude Code process. This vulnerability is fixed in 3.5.2.",
"severity": "high",
"affected_products": [
{
"vendor": "cnighswonger",
"product": "claude-code-cache-fix",
"version_affected": "< 3.5.2",
"version_fixed": "3.5.2"
}
],
"cwe_ids": [
"CWE-78",
"CWE-94"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-45136",
"https://github.com/cnighswonger/claude-code-cache-fix/issues/108",
"https://github.com/cnighswonger/claude-code-cache-fix/pull/110",
"https://github.com/cnighswonger/claude-code-cache-fix/security/advisories/GHSA-g3xq-3gmv-qq8g",
"https://github.com/cnighswonger/claude-code-cache-fix/issues/108",
"https://github.com/cnighswonger/claude-code-cache-fix/security/advisories/GHSA-g3xq-3gmv-qq8g"
],
"published_at": "2026-05-27T21:16:18.523",
"cvss_score": 7.8
},
{
"id": "CVE-2026-45033",
"title": "GitHub Copilot CLI brings AI-powered coding assistance directly to your command line",
"description": "GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory traversal, an attacker can set core.fsmonitor or other executable config keys to run arbitrary commands without user awareness or approval. The vulnerability arises because git's core.fsmonitor config key (and 15+ similar keys such as core.hookspath, diff.external, merge.tool, etc.) can specify arbitrary shell commands that git will execute as part of normal operations like status, diff, or rev-parse. This vulnerability is fixed in 1.0.43.",
"severity": "high",
"affected_products": [
{
"vendor": "github",
"product": "copilot-cli",
"version_affected": "< 1.0.43",
"version_fixed": "1.0.43"
}
],
"cwe_ids": [
"CWE-696"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-45033",
"https://github.com/github/copilot-cli/security/advisories/GHSA-9ccr-r5hg-74gf",
"https://github.com/github/copilot-cli/security/advisories/GHSA-9ccr-r5hg-74gf"
],
"published_at": "2026-05-13T16:17:00.313",
"cvss_score": 7.8
},
{
"id": "CVE-2026-44470",
"title": "The Claude Desktop app gives you Claude Code with a graphical interface built for running multipl...",
"description": "The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. Prior to 1.3834.0, the CoworkVMService component in Claude Desktop for Windows ran as SYSTEM and did not validate whether the VM bundle directory was a real directory or an NTFS directory junction before creating files within it. A local non-elevated user could replace the user-writable VM bundle directory with a directory junction pointing to an attacker-chosen location, causing the service to create a SYSTEM-owned file in an arbitrary directory. This could be leveraged for local privilege escalation. This vulnerability is fixed in 1.3834.0.",
"severity": "high",
"affected_products": [
{
"vendor": "anthropic",
"product": "claude_desktop",
"version_affected": "< 1.3834.0",
"version_fixed": "1.3834.0"
},
{
"vendor": "microsoft",
"product": "windows",
"version_affected": "*",
"version_fixed": null
}
],
"cwe_ids": [
"CWE-269",
"CWE-59"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-44470",
"https://github.com/anthropics/claude-code/security/advisories/GHSA-5p5x-5294-qhp3"
],
"published_at": "2026-05-13T16:16:58.263",
"cvss_score": 7.8
},
{
"id": "CVE-2026-44467",
"title": "The Claude Desktop app gives you Claude Code with a graphical interface built for running multipl...",
"description": "The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4304.0, Claude Desktop's SSH remote development feature verified only whether a hostname existed in ~/.ssh/known_hosts without comparing the server's presented host key against the stored key. This allowed a network-positioned attacker to present an arbitrary SSH host key and have the connection silently accepted, enabling a man-in-the-middle attack on remote development sessions. Successful exploitation required the attacker to be in a network position to intercept SSH traffic (e.g., via ARP spoofing, rogue Wi-Fi, or DNS poisoning) and the target hostname to already have an entry in the victim's known_hosts file. This vulnerability is fixed in 1.4304.0.",
"severity": "medium",
"affected_products": [
{
"vendor": "anthropic",
"product": "claude_desktop",
"version_affected": "< 1.4304.0",
"version_fixed": "1.4304.0"
}
],
"cwe_ids": [
"CWE-297",
"CWE-322"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-44467",
"https://github.com/anthropics/claude-code/security/advisories/GHSA-3rwf-2g6p-c2f9"
],
"published_at": "2026-05-13T16:16:58.100",
"cvss_score": 6.8
},
{
"id": "CVE-2026-41109",
"title": "Improper neutralization of special elements in output used by a downstream component ('injection'...",
"description": "Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.",
"severity": "high",
"affected_products": [
{
"vendor": "microsoft",
"product": "visual_studio_code",
"version_affected": "< 1.119.1",
"version_fixed": "1.119.1"
}
],
"cwe_ids": [
"CWE-74"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-41109",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41109"
],
"published_at": "2026-05-12T18:17:22.210",
"cvss_score": 8.8
},
{
"id": "CVE-2026-40068",
"title": "In versions 2",
"description": "In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir file without validating its contents. An attacker could craft a malicious repository with a commondir file pointing to a path the victim had previously trusted, causing Claude Code to bypass its trust confirmation dialog and immediately execute hooks defined in `.claude/settings.json`. Exploitation requires the victim to clone the malicious repository and run Claude Code within it, and the attacker must know or guess a path the victim had already trusted. This issue has been fixed in version 2.1.84.",
"severity": "high",
"affected_products": [
{
"vendor": "anthropic",
"product": "claude_code",
"version_affected": "< 2.1.84",
"version_fixed": "2.1.84"
}
],
"cwe_ids": [
"CWE-77",
"CWE-20"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-40068",
"https://github.com/anthropics/claude-code/security/advisories/GHSA-q5hj-mxqh-vv77"
],
"published_at": "2026-05-05T21:16:23.093",
"cvss_score": 8.8
},
{
"id": "CVE-2026-39861",
"title": "Claude Code is an agentic coding tool",
"description": "Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink, its unsandboxed process followed the symlink and wrote to the target location outside the workspace without prompting the user for confirmation. This allowed a sandbox escape where neither the sandboxed command nor the unsandboxed app could independently write outside the workspace, but their combination could write to arbitrary locations, potentially leading to code execution outside the sandbox. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window to trigger sandboxed code execution via prompt injection. Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to version 2.1.64 or later.",
"severity": "critical",
"affected_products": [
{
"vendor": "anthropic",
"product": "claude_code",
"version_affected": "< 2.1.64",
"version_fixed": "2.1.64"
}
],
"cwe_ids": [
"CWE-61",
"CWE-22"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-39861",
"https://github.com/anthropics/claude-code/security/advisories/GHSA-vp62-r36r-9xqp"
],
"published_at": "2026-04-21T01:16:06.647",
"cvss_score": 10.0
},
{
"id": "CVE-2026-35603",
"title": "Claude Code is an agentic coding tool",
"description": "Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration from C:\\ProgramData\\ClaudeCode\\managed-settings.json without validating directory ownership or access permissions. Because the ProgramData directory is writable by non-administrative users by default and the ClaudeCode subdirectory was not pre-created or access-restricted, a low-privileged local user could create this directory and place a malicious configuration file that would be automatically loaded for any user launching Claude Code on the same machine. Exploiting this would have required a shared multi-user Windows system and a victim user to launch Claude Code after the malicious configuration was placed. This issue has been fixed on version 2.1.75.",
"severity": "high",
"affected_products": [
{
"vendor": "anthropic",
"product": "claude_code",
"version_affected": "< 2.1.75",
"version_fixed": "2.1.75"
},
{
"vendor": "microsoft",
"product": "windows",
"version_affected": "*",
"version_fixed": null
}
],
"cwe_ids": [
"CWE-426"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-35603",
"https://github.com/anthropics/claude-code/security/advisories/GHSA-5cwg-9f6j-9jvx"
],
"published_at": "2026-04-17T21:16:33.507",
"cvss_score": 7.3
},
{
"id": "CVE-2026-39884",
"title": "mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management",
"description": "mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior contain an argument injection vulnerability in the port_forward tool in src/tools/port_forward.ts, where a kubectl command is constructed via string concatenation with user-controlled input and then naively split on spaces before being passed to spawn(). Unlike all other tools in the codebase which correctly use array-based argument passing with execFileSync(), port_forward treats every space in user-controlled fields (namespace, resourceType, resourceName, localPort, targetPort) as an argument boundary, allowing an attacker to inject arbitrary kubectl flags. This enables exposure of internal Kubernetes services to the network by injecting --address=0.0.0.0, cross-namespace targeting by injecting additional -n flags, and indirect exploitation via prompt injection against AI agents connected to the MCP server. This issue has been fixed in version 3.5.0.",
"severity": "high",
"affected_products": [
{
"vendor": "suyogs",
"product": "mcp-server-kubernetes",
"version_affected": "< 3.5.0",
"version_fixed": "3.5.0"
}
],
"cwe_ids": [
"CWE-88"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-39884",
"https://github.com/Flux159/mcp-server-kubernetes/releases/tag/v3.5.0",
"https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-4xqg-gf5c-ghwq",
"https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-4xqg-gf5c-ghwq"
],
"published_at": "2026-04-15T04:17:37.097",
"cvss_score": 8.3
},
{
"id": "CVE-2026-23653",
"title": "Improper neutralization of special elements used in a command ('command injection') in GitHub Cop...",
"description": "Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network.",
"severity": "medium",
"affected_products": [
{
"vendor": "microsoft",
"product": "github_copilot_chat",
"version_affected": "< 0.37.3",
"version_fixed": "0.37.3"
}
],
"cwe_ids": [
"CWE-77"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-23653",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23653"
],
"published_at": "2026-04-14T18:16:44.137",
"cvss_score": 5.7
},
{
"id": "CVE-2026-35577",
"title": "Apollo MCP Server is a Model Context Protocol server that exposes GraphQL operations as MCP tools",
"description": "Apollo MCP Server is a Model Context Protocol server that exposes GraphQL operations as MCP tools. Prior to version 1.7.0, the Apollo MCP Server did not validate the Host header on incoming HTTP requests when using StreamableHTTP transport. In configurations where an HTTP-based MCP server is run on localhost without additional authentication or network-level controls, this could potentially allow a malicious website\u2014visited by a user running the server locally\u2014to use DNS rebinding techniques to bypass same-origin policy restrictions and issue requests to the local MCP server. If successfully exploited, this could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the local user. This issue is limited to HTTP-based transport modes (StreamableHTTP). It does not affect servers using stdio transport. The practical risk is further reduced in deployments that use authentication, network-level access controls, or are not bound to localhost. This vulnerability is fixed in 1.7.0.",
"severity": "medium",
"affected_products": [
{
"vendor": "apollographql",
"product": "apollo_mcp_server",
"version_affected": "< 1.7.0",
"version_fixed": "1.7.0"
}
],
"cwe_ids": [
"CWE-346"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-35577",
"https://github.com/apollographql/apollo-mcp-server/pull/602",
"https://github.com/apollographql/apollo-mcp-server/pull/635",
"https://github.com/apollographql/apollo-mcp-server/security/advisories/GHSA-wqrj-vp8w-f8vh"
],
"published_at": "2026-04-09T20:16:25.987",
"cvss_score": 6.8
},
{
"id": "CVE-2026-39885",
"title": "FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP)",
"description": "FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing $ref values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the initialize() call. This enables Server-Side Request Forgery (SSRF) and local file read attacks when processing untrusted OpenAPI specifications. This vulnerability is fixed in 2.3.0.",
"severity": "high",
"affected_products": [
{
"vendor": "agentfront",
"product": "\\@frontmcp\\/adapters",
"version_affected": "< 1.0.4",
"version_fixed": "1.0.4"
},
{
"vendor": "agentfront",
"product": "\\@frontmcp\\/sdk",
"version_affected": "< 1.0.4",
"version_fixed": "1.0.4"
},
{
"vendor": "agentfront",
"product": "frontmcp",
"version_affected": "< 1.0.4",
"version_fixed": "1.0.4"
},
{
"vendor": "frontmcp",
"product": "mcp-from-openapi",
"version_affected": "< 2.3.0",
"version_fixed": "2.3.0"
}
],
"cwe_ids": [
"CWE-918"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-39885",
"https://github.com/agentfront/frontmcp/releases/tag/v1.0.4",
"https://github.com/agentfront/frontmcp/security/advisories/GHSA-v6ph-xcq9-qxxj",
"https://github.com/agentfront/frontmcp/security/advisories/GHSA-v6ph-xcq9-qxxj"
],
"published_at": "2026-04-08T21:17:00.833",
"cvss_score": 7.5
},
{
"id": "CVE-2026-35568",
"title": "MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients",
"description": "MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk contains a DNS rebinding vulnerability. This vulnerability allows an attacker to access a locally or network-private java-sdk MCP server via a victims browser that is either local, or network adjacent. This allows an attacker to make any tool call to the server as if they were a locally running MCP connected AI agent. This vulnerability is fixed in 1.0.0.",
"severity": "medium",
"affected_products": [
{
"vendor": "lfprojects",
"product": "mcp_java_sdk",
"version_affected": "< 1.0.0",
"version_fixed": "1.0.0"
}
],
"cwe_ids": [
"CWE-346"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-35568",
"https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.0.0",
"https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-8jxr-pr72-r468"
],
"published_at": "2026-04-07T22:16:23.433",
"cvss_score": 5.7
},
{
"id": "CVE-2026-34742",
"title": "The Go MCP SDK used Go's standard encoding/json",
"description": "The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPHandler or SSEHandler, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. This issue has been patched in version 1.4.0.",
"severity": "high",
"affected_products": [
{
"vendor": "lfprojects",
"product": "mcp_go_sdk",
"version_affected": "< 1.4.0",
"version_fixed": "1.4.0"
}
],
"cwe_ids": [
"CWE-1188"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-34742",
"https://github.com/modelcontextprotocol/go-sdk/commit/67bd3f2e2b53ce11a16db8d976cdb8ff1e986b6d",
"https://github.com/modelcontextprotocol/go-sdk/pull/760",
"https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.4.0",
"https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-xw59-hvm2-8pj6",
"https://access.redhat.com/errata/RHSA-2026:21772"
],
"published_at": "2026-04-02T19:21:33.023",
"cvss_score": 8.1
},
{
"id": "CVE-2025-66032",
"title": "Claude Code is an agentic coding tool",
"description": "Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. This vulnerability is fixed in 1.0.93.",
"severity": "critical",
"affected_products": [
{
"vendor": "anthropic",
"product": "claude_code",
"version_affected": "< 1.0.93",
"version_fixed": "1.0.93"
}
],
"cwe_ids": [
"CWE-77"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2025-66032",
"https://github.com/anthropics/claude-code/security/advisories/GHSA-xq4m-mc3c-vvg3"
],
"published_at": "2025-12-03T19:15:57.527",
"cvss_score": 9.8
},
{
"id": "CVE-2025-64755",
"title": "Claude Code is an agentic coding tool",
"description": "Claude Code is an agentic coding tool. Prior to version 2.0.31, due to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. This issue has been patched in version 2.0.31.",
"severity": "critical",
"affected_products": [
{
"vendor": "anthropic",
"product": "claude_code",
"version_affected": "< 2.0.31",
"version_fixed": "2.0.31"
}
],
"cwe_ids": [
"CWE-78"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2025-64755",
"https://github.com/anthropics/claude-code/security/advisories/GHSA-7mv8-j34q-vp7q"
],
"published_at": "2025-11-21T02:15:43.917",
"cvss_score": 9.8
},
{
"id": "CVE-2025-64660",
"title": "Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to...",
"description": "Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.",
"severity": "high",
"affected_products": [
{
"vendor": "microsoft",
"product": "visual_studio_code",
"version_affected": "< 1.106.2",
"version_fixed": "1.106.2"
}
],
"cwe_ids": [
"CWE-284"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2025-64660",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64660"
],
"published_at": "2025-11-20T23:15:56.943",
"cvss_score": 8.0
},
{
"id": "CVE-2025-65099",
"title": "Claude Code is an agentic coding tool",
"description": "Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Exploiting this would have required a user to start Claude Code in an untrusted directory and to be using Yarn 3.0 or above. This issue has been patched in version 1.0.39.",
"severity": "critical",
"affected_products": [
{
"vendor": "anthropic",
"product": "claude_code",
"version_affected": "< 1.0.39",
"version_fixed": "1.0.39"
}
],
"cwe_ids": [
"CWE-94"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2025-65099",
"https://github.com/anthropics/claude-code/security/advisories/GHSA-5hhx-v7f6-x7gv"
],
"published_at": "2025-11-19T18:15:51.837",
"cvss_score": 9.8
},
{
"id": "CVE-2025-62453",
"title": "Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an au...",
"description": "Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.",
"severity": "medium",
"affected_products": [
{
"vendor": "microsoft",
"product": "visual_studio_code",
"version_affected": "< 1.105.0",
"version_fixed": "1.105.0"
}
],
"cwe_ids": [
"CWE-693"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2025-62453",
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62453"
],
"published_at": "2025-11-11T18:15:50.423",
"cvss_score": 5.0
},
{
"id": "CVE-2025-54135",
"title": "Cursor CurXecute Remote Code Execution",
"description": "A vulnerability in Cursor IDE allows remote code execution through specially crafted project files. Attackers can execute arbitrary code when a victim opens a malicious project.",
"severity": "high",
"cvss_score": 8.8,
"affected_products": [
{
"vendor": "cursor",
"product": "cursor",
"version_affected": "< 0.45.0",
"version_fixed": "0.45.0"
}
],
"cwe_ids": [
"CWE-94",
"CWE-78"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2025-54135"
],
"published_at": "2025-01-20T00:00:00Z"
},
{
"id": "CVE-2025-54136",
"title": "Cursor MCPoison MCP Server Hijacking",
"description": "MCPoison vulnerability in Cursor IDE allows attackers to hijack MCP server connections through environment variable manipulation, potentially leading to data exfiltration or malicious code execution.",
"severity": "high",
"cvss_score": 8.5,
"affected_products": [
{
"vendor": "cursor",
"product": "cursor",
"version_affected": "< 0.45.0",
"version_fixed": "0.45.0"
}
],
"cwe_ids": [
"CWE-426",
"CWE-200"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2025-54136"
],
"published_at": "2025-01-20T00:00:00Z"
},
{
"id": "CVE-2025-6514",
"title": "mcp-remote Remote Code Execution",
"description": "A critical vulnerability in the mcp-remote package allows remote code execution through malicious MCP server responses. Attackers can execute arbitrary code on the client machine.",
"severity": "critical",
"cvss_score": 9.6,
"affected_products": [
{
"vendor": "modelcontextprotocol",
"product": "mcp-remote",
"version_affected": "< 0.3.0",
"version_fixed": "0.3.0"
}
],
"cwe_ids": [
"CWE-94",
"CWE-502"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2025-6514"
],
"published_at": "2025-01-18T00:00:00Z"
},
{
"id": "CVE-2025-52882",
"title": "Claude Code VSCode WebSocket Authentication Bypass",
"description": "A vulnerability in Claude Code VSCode extension allows remote attackers to bypass WebSocket authentication, potentially leading to unauthorized code execution within the extension context.",
"severity": "critical",
"cvss_score": 9.8,
"affected_products": [
{
"vendor": "anthropic",
"product": "claude-code-vscode",
"version_affected": "< 1.5.0",
"version_fixed": "1.5.0"
}
],
"cwe_ids": [
"CWE-287",
"CWE-306"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2025-52882"
],
"published_at": "2025-01-15T00:00:00Z"
},
{
"id": "CVE-2025-53110",
"title": "MCP Directory Traversal",
"description": "A directory traversal vulnerability in MCP file operations allows attackers to read or write files outside the intended directory scope.",
"severity": "high",
"cvss_score": 7.3,
"affected_products": [
{
"vendor": "modelcontextprotocol",
"product": "mcp",
"version_affected": "< 1.0.0",
"version_fixed": "1.0.0"
}
],
"cwe_ids": [
"CWE-22",
"CWE-73"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2025-53110"
],
"published_at": "2025-01-12T00:00:00Z"
},
{
"id": "CVE-2025-53109",
"title": "MCP Symbolic Link Bypass",
"description": "A vulnerability in MCP's file access controls allows attackers to bypass path restrictions using symbolic links, potentially accessing sensitive files outside the allowed scope.",
"severity": "high",
"cvss_score": 8.4,
"affected_products": [
{
"vendor": "modelcontextprotocol",
"product": "mcp",
"version_affected": "< 1.0.0",
"version_fixed": "1.0.0"
}
],
"cwe_ids": [
"CWE-59",
"CWE-61"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2025-53109"
],
"published_at": "2025-01-12T00:00:00Z"
},
{
"id": "CVE-2025-49596",
"title": "MCP Inspector CSRF to RCE",
"description": "MCP Inspector is vulnerable to Cross-Site Request Forgery (CSRF) attacks that can lead to Remote Code Execution (RCE). An attacker can craft a malicious web page that, when visited by a user with MCP Inspector running, can execute arbitrary commands.",
"severity": "critical",
"cvss_score": 9.4,
"affected_products": [
{
"vendor": "modelcontextprotocol",
"product": "mcp-inspector",
"version_affected": "< 0.5.0",
"version_fixed": "0.5.0"
}
],
"cwe_ids": [
"CWE-352",
"CWE-94"
],
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2025-49596"
],
"published_at": "2025-01-10T00:00:00Z"
}
]
}