Login Request a demo
RE
Product
registry
by modelcontextprotocol · last CVE May 14, 2026
5
CVEs
0
On KEV
5.4
Max CVSS
0
New 30D
Vulnerabilities5In the news0Timeline
Severity mix
Critical 0High 0Medium 3Low 1
Severity
All severities5Critical0High0Medium3Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add registry to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-44429
5.4
0%
May 14
MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`
Affected: < 1.7.7
CVE-2026-44428
4.7
0%
May 14
MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience
Affected: < 1.7.6
CVE-2026-44430
4.0
0%
May 14
MCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist
Affected: < 1.7.7
CVE-2026-45781
3.5
0%
May 14
MCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claims
Affected: < 1.7.9
CVE-2026-44427
0.0
0%
May 14
MCP Registry: Open Redirect
Affected: >= 1.1.0, < 1.7.5
Showing 5