{"data":{"ecosystem":"pypi","name":"mcp","url":"https://aisecwatch.com/packages/pypi/mcp","latestVersion":"2.3.0","firstReleaseAt":"2024-11-20T11:37:34.333Z","repository":"https://github.com/modelcontextprotocol/python-sdk","llm":{"exposure":"direct","depth":0,"integratedAt":"2024-11-20T11:37:34.333Z","integratedVersion":"0.9.1","sdks":["mcp"],"path":[]},"authority":{"profile":[],"fromDependencies":[]},"dependencies":[{"ecosystem":"pypi","name":"anyio","versionSpec":">=4.10","scope":"runtime"},{"ecosystem":"pypi","name":"httpx2","versionSpec":">=2.10.0","scope":"runtime"},{"ecosystem":"pypi","name":"jsonschema","versionSpec":">=4.20.0","scope":"runtime"},{"ecosystem":"pypi","name":"mcp-types","versionSpec":"==2.3.0","scope":"runtime"},{"ecosystem":"pypi","name":"opentelemetry-api","versionSpec":">=1.28.0","scope":"runtime"},{"ecosystem":"pypi","name":"pydantic","versionSpec":">=2.12.0","scope":"runtime"},{"ecosystem":"pypi","name":"pyjwt","versionSpec":">=2.10.1","scope":"runtime"},{"ecosystem":"pypi","name":"python-dotenv","versionSpec":">=1.0.0","scope":"extra:cli"},{"ecosystem":"pypi","name":"python-multipart","versionSpec":">=0.0.9","scope":"runtime"},{"ecosystem":"pypi","name":"pywin32","versionSpec":">=311","scope":"runtime"},{"ecosystem":"pypi","name":"rich","versionSpec":">=13.9.4","scope":"extra:rich"},{"ecosystem":"pypi","name":"sse-starlette","versionSpec":">=3.0.0","scope":"runtime"},{"ecosystem":"pypi","name":"starlette","versionSpec":">=0.27","scope":"runtime"},{"ecosystem":"pypi","name":"typer","versionSpec":">=0.16.0","scope":"extra:cli"},{"ecosystem":"pypi","name":"typing-extensions","versionSpec":">=4.13.0","scope":"runtime"},{"ecosystem":"pypi","name":"typing-inspection","versionSpec":">=0.4.1","scope":"runtime"},{"ecosystem":"pypi","name":"uvicorn","versionSpec":">=0.31.1","scope":"runtime"}],"advisories":[{"id":"926d47ed-94ab-4ad5-b21c-d6ce039915f5","url":"https://aisecwatch.com/issues/926d47ed-94ab-4ad5-b21c-d6ce039915f5","cveId":"CVE-2026-59950","title":"GHSA-vj7q-gjh5-988w: MCP Python SDK: WebSocket server transport does not support Host/Origin validation","headline":null,"severity":"high","publishedAt":"2026-07-16T20:14:34.000Z","affected":["mcp@< 1.28.1 (fixed: 1.28.1)"],"epssScore":0.00231},{"id":"493c0843-a7e2-44f3-9f98-6d5a6c3e2b4a","url":"https://aisecwatch.com/issues/493c0843-a7e2-44f3-9f98-6d5a6c3e2b4a","cveId":"CVE-2026-52869","title":"GHSA-jpw9-pfvf-9f58: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal","headline":null,"severity":"high","publishedAt":"2026-07-16T19:58:53.000Z","affected":["mcp@<= 1.27.1 (fixed: 1.27.2)"],"epssScore":0.00535},{"id":"453d7cc8-0735-4752-8c4e-c6792e82d381","url":"https://aisecwatch.com/issues/453d7cc8-0735-4752-8c4e-c6792e82d381","cveId":"CVE-2026-52870","title":"GHSA-hvrp-rf83-w775: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks","headline":null,"severity":"high","publishedAt":"2026-07-16T19:56:12.000Z","affected":["mcp@>= 1.23.0, <= 1.27.1 (fixed: 1.27.2)"],"epssScore":0.00388},{"id":"506526da-98e6-4d79-b4f9-8129a443be2b","url":"https://aisecwatch.com/issues/506526da-98e6-4d79-b4f9-8129a443be2b","cveId":"CVE-2025-66416","title":"GHSA-9h52-p55h-vw2f: Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default","headline":null,"severity":"high","publishedAt":"2025-12-02T16:52:08.000Z","affected":["mcp@< 1.23.0 (fixed: 1.23.0)"],"epssScore":0.00512},{"id":"e8934b7b-929d-4958-807a-3e98328d1123","url":"https://aisecwatch.com/issues/e8934b7b-929d-4958-807a-3e98328d1123","cveId":"CVE-2025-53366","title":"GHSA-3qhf-m339-9g5v: MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS","headline":null,"severity":"high","publishedAt":"2025-07-04T22:06:49.000Z","affected":["mcp@< 1.9.4 (fixed: 1.9.4)"],"epssScore":0.09309},{"id":"0671587c-9f82-4369-9be1-f8bb63a20ed1","url":"https://aisecwatch.com/issues/0671587c-9f82-4369-9be1-f8bb63a20ed1","cveId":"CVE-2025-53365","title":"GHSA-j975-95f5-7wqh: MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service","headline":null,"severity":"high","publishedAt":"2025-07-04T22:06:31.000Z","affected":["mcp@< 1.10.0 (fixed: 1.10.0)"],"epssScore":0.00419}],"checkedAt":"2026-10-09T21:55:07.011Z"},"meta":{"advisoryMatching":"by package name; advisory records do not state an ecosystem"}}