PY
Product
python-sdk
8
CVEs
0
On KEV
8.1
Max CVSS
5
New 30D
Severity mix
Critical 0High 4Medium 4Low 0
Watch
Add python-sdk to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-59950 | 8.1 | Jul 15 | MCP Python SDK: WebSocket server transport does not support Host/Origin validation Affected: < 1.28.1 |
| CVE-2026-52870 | 7.6 | Jul 15 | MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks Affected: >= 1.23.0, < 1.27.2 |
| CVE-2026-109527 | 7.5 | Oct 14 | Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies Affected: < 1.29.1; >= 2.0.0a1, < 2.1.0 |
| CVE-2026-52869 | 7.1 | Jul 15 | MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal Affected: < 1.27.2 |
| CVE-2026-59951 | 6.9 | Oct 14 | MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion Affected: >= 1.8.0, < 1.30.0; >= 2.0.0, < 2.2.0 |
| CVE-2026-116684 New | 6.8 | Oct 27 | Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server Affected: >= 1.10.0, < 1.30.0; >= 2.0.0, < 2.2.0 |
| CVE-2026-116686 New | 6.5 | Oct 27 | Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas Affected: >= 1.10.0, < 1.30.0; >= 2.0.0, < 2.2.0 |
| CVE-2026-116685 New | 5.9 | Oct 27 | Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies Affected: >= 1.8.0, < 1.30.0; >= 2.0.0, < 2.2.0 |
Showing 8