Vulnerabilities
Summary — last 7 days
New vulnerabilities2,950▲ 8 vs. last week
Critical / high1,450▲ 184 vs. last week
New active exploitation (KEV)5▼ 3 vs. last week
Unscored (no CVSS)272▼ 254 vs. last week
2 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (7.3) | 1.2% | — | Lstm-kirigaya Openmcp-clientAI | 8/28/2025 | 6/17/2026 | LSTM-Kirigaya's openmcp-client is a vscode plugin for mcp developer. Prior to version 0.1.12, when users on a Windows platform connect to an attacker controlled MCP server, attackers could provision a malicious authorization server endpoint to silently achieve an OS command injection attack in the open() invocation,… | |
| Analyzed | Low (2.9) | 4.3% | — | Wong2 Mcp-cli | 8/20/2025 | 6/17/2026 | A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitability is… |