| Date | Type | Description | CVE | CVSS |
|---|---|---|---|---|
| 2026-08-25 | Code Injection | Marimo Notebook < 0.23.15 executes attacker-supplied MCP command as local subprocess when opened in edit mode | CVE-2026-75149 | 8.8 (v3.1) |
| 2026-08-18 | Prompt Injection | Context7 MCP Server ≤ 2.1.2 — crafted tool output enables instruction override; no public fix documented | CVE-2026-75130 | 9.0 (v3.1) |
| 2026-08-10 | Cross-Channel Trust Fragmentation | GhostSplice — malicious MCP server splits exfiltration instructions across tool description, tool result, and sampling channels; agent stitches fragments to steal SSH keys/secrets. 11 frontier models tested, 100% compliance | Pending | N/A |
| 2026-07-29 | Session Hijacking | MCP Ruby SDK < 0.23.0 — StreamableHTTPTransport does not bind session ID to owner; stolen session ID allows arbitrary tool execution in victim's session | CVE-2026-67431 | 8.3 |
| 2026-05-12 | Supply Chain / Self-Propagating Worm | Mini Shai-Hulud — 42 @tanstack npm packages compromised via chained GitHub Actions; SLSA L3 attestation forgery, OIDC token extraction, MCP persistence hooks in Claude Code/VS Code; 420+ packages, 2B monthly installs | CVE-2026-45321 | 9.6 |
| 2026-04-20 | Design Flaw / RCE | "Mother of All AI Supply Chains" (OX Security) — systemic RCE in Anthropic MCP SDK (Python, TS, Java, Rust) via STDIO interface; any process command executes on host regardless of valid MCP server init. Affects Flowise, LettaAI, LangFlow, Windsurf | CVE-2026-40933 | N/A |
| 2026-04-20 | Prompt Injection → Command Injection | Windsurf 1.9544.26 — attacker-controlled HTML causes unauthorized MCP config edit and auto-registration of malicious STDIO server, executing arbitrary commands zero-click | CVE-2026-30615 | N/A |
| 2026-03 | Authentication Bypass → RCE | nginx-ui MCP message endpoint fails to authenticate command execution requests; 2,600+ exposed instances; complete nginx service takeover | CVE-2026-33032 | 9.8 |
| 2026-02-04 | Cross-Tenant Data Leak | MCP TypeScript SDK 1.10.0–1.25.3 — cross-client response data leak when McpServer/Server + transport instance reused across multiple client connections (stateless StreamableHTTPServerTransport) | CVE-2026-25536 | N/A |
| 2026-01-16 | RCE (Missing Auth + 0.0.0.0 Binding) | MCPJam Inspector listens on 0.0.0.0 by default; crafted HTTP request triggers MCP server installation → full RCE without authentication | CVE-2026-23744 | 9.1 |
| 2025-07-09 | OS Command Injection → RCE | mcp-remote 0.0.5–0.1.15 — crafted authorization_endpoint response URL from untrusted MCP server triggers arbitrary OS command execution on client; 437,000+ downloads affected | CVE-2025-6514 | 9.6 |
| 2025 (est) | Missing Authentication | MCP Inspector Proxy Server — no authentication on local proxy; any local process could invoke MCP server tools | CVE-2025-49596 | 9.4 |
Sources: NVD, OX Security, ASSET Research Group, Tenable, Cloud Security Alliance, The Hacker News, JFrog. "N/A" = CVSS not yet assigned or not publicly documented at time of retrieval. GhostSplice CVE pending coordinated disclosure as of Aug 27, 2026.