durinMCP IndexSuggest Provider

MCP security advisories

Search public advisory summaries. Detailed affected versions, remediation and evidence are available in the verified browser view.

20 advisory summaries · Page 1

AdvisorySeverityStateUpdated
PYSEC-2026-2630: mcp-server-git : Path traversal in git_add allows staging files outside repository boundariesDURIN-MCP-2026-000020unknownpublished2026-11-09
PYSEC-2026-1623: mcp-server-git has missing path validation when using --repository flagDURIN-MCP-2026-000019unknownpublished2026-11-09
PYSEC-2026-1622: mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local filesDURIN-MCP-2026-000018unknownpublished2026-11-09
GHSA-vjqx-cfc4-9h6v: mcp-server-git : Path traversal in git_add allows staging files outside repository boundariesDURIN-MCP-2026-000016mediumpublished2026-11-09
PYSEC-2026-1621: mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locationsDURIN-MCP-2026-000017unknownpublished2026-11-09
GHSA-5cgr-j3jf-jw3v: mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locationsDURIN-MCP-2026-000015mediumpublished2026-11-09
GHSA-j22h-9j4x-23w5: mcp-server-git has missing path validation when using --repository flagDURIN-MCP-2026-000013mediumpublished2026-11-09
GHSA-9xwc-hfwc-8w59: mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local filesDURIN-MCP-2026-000014mediumpublished2026-11-09
GHSA-hpqj-7cj6-hfj8: Snyk CLI affected by Command Injection vulnerabilityDURIN-MCP-2026-000012highpublished2026-11-09
GHSA-6hwc-9h8r-3vmf: Snyk CLI Insertion of Sensitive Information into Log File allowed in DEBUG or DEBUG/TRACE modeDURIN-MCP-2026-000010lowpublished2026-11-09
GHSA-6xpm-ggf7-wc3p: mcp-remote exposed to OS command injection via untrusted MCP server connectionsDURIN-MCP-2026-000011criticalpublished2026-11-09
GHSA-4vrv-93c7-m92j: snyk Code Injection vulnerabilityDURIN-MCP-2026-000009highpublished2026-11-09
GHSA-4x6g-3cmx-w76r: Snyk plugins vulnerable to Command InjectionDURIN-MCP-2026-000006mediumpublished2026-11-09
GHSA-mwwr-p57h-56pf: @bytebase/dbhub's read-only mode does not prevent database writesDURIN-MCP-2026-000007highpublished2026-11-09
GHSA-6fg3-hvw7-2fwq: Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server ToolsDURIN-MCP-2026-000008highpublished2026-11-09
GHSA-hc55-p739-j48w: @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefixDURIN-MCP-2026-000005highpublished2026-11-09
GHSA-q66q-fx2p-7w4m: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handlingDURIN-MCP-2026-000004highpublished2026-11-09
GHSA-fm8p-53ww-hf6w: DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL executionDURIN-MCP-2026-000003criticalpublished2026-11-09
GHSA-hhfx-wfvq-7g9c: Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a networkDURIN-MCP-2026-000002highpublished2026-11-09
GHSA-j656-3hf2-fvjc: DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validationDURIN-MCP-2026-000001mediumpublished2026-11-09

Complete the browser check below to explore the full advisory table and assessment evidence.

Loading the verified browser view…