Login Request a demo
MC
Product
mcphub
by samanhappy · last CVE Sep 20, 2026
13
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities13In the news0Timeline
Severity mix
Critical 2High 7Medium 4Low 0
Severity
All severities13Critical2High7Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add mcphub to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-79744
8.8
1%
Aug 31
MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration
Affected: < 1.0.29
CVE-2025-11285
8.8
8%
Oct 5
samanhappy MCPHub serverController.ts os command injection
Affected: 0.9.0; 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.5; +5 more
CVE-2026-79746
8.1
0%
Aug 31
MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching
Affected: < 1.0.31
CVE-2026-79750
7.7
0%
Aug 31
MCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF)
Affected: < 1.0.30
CVE-2026-79749
7.6
0%
Aug 31
MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation
Affected: < 1.0.32
CVE-2026-79745
7.1
0%
Aug 31
MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)
Affected: < 1.0.32
CVE-2026-79747
7.1
0%
Aug 31
MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)
Affected: < 1.0.32
Showing 7