Login Request a demo
FA
Product
fastmcp
by jlowin · last CVE Apr 3, 2026
6
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 1High 2Medium 3Low 0
Severity
All severities6Critical1High2Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add fastmcp to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-32871
10.0
1%
Apr 2
FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
Affected: before 3.2.0
CVE-2025-64340
7.8
1%
Apr 3
FastMCP has a Command Injection vulnerability - Gemini CLI
Affected: < 3.2.0
CVE-2025-62801
7.8
0%
Oct 28
FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name
Affected: < 2.13.0
CVE-2025-69196
6.5
0%
Mar 16
FastMCP OAuth Proxy token reuse across MCP servers
Affected: < 2.14.2
CVE-2026-27124
6.1
0%
Apr 3
FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities
Affected: < 3.2.0
CVE-2025-62800
6.1
0%
Oct 28
FastMCP vulnerable to reflected XSS in client's callback page
Affected: < 2.13.0
Showing 6