GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
8 advisories
@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification
Moderate
GHSA-xrmj-5g4g-8987
was published
for
@dynatrace-oss/dynatrace-mcp-server
(npm)
Jul 31, 2026
@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL
Moderate
GHSA-pqh8-p93p-2rx7
was published
for
@dynatrace-oss/dynatrace-mcp-server
(npm)
Jul 31, 2026
MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration
Moderate
CVE-2026-47250
was published
for
mcp-server-kubernetes
(npm)
Jun 5, 2026
Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching
Moderate
CVE-2026-46341
was published
for
@apify/actors-mcp-server
(npm)
May 19, 2026
Nginx-UI Settings API Exposes Protected Secrets
Moderate
CVE-2026-42223
was published
for
github.com/0xJacky/nginx-ui
(Go)
May 6, 2026
ha-mcp has XSS via Unescaped HTML in OAuth Consent Form
Moderate
CVE-2026-32112
was published
for
ha-mcp
(pip)
Mar 12, 2026
ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
Moderate
CVE-2026-32111
was published
for
ha-mcp
(pip)
Mar 12, 2026
mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint
Moderate
CVE-2026-29787
was published
for
mcp-memory-service
(pip)
Mar 5, 2026
ProTip!
Advisories are also available from the
GraphQL API