Topic
Reported critical CVEs in MCP SDKs and their claimed server-level blast radius.
Pen Test Partners says the battery maker declined to fix exposed older installs and did not act when the UK regulator asked. On 9 April 2026 it entered administration.
Reality
Adversa says it hid data-exfiltration instructions in AES-256-GCM ciphertext and let Grok decrypt them in its own Python sandbox. The plaintext version of the same attack was refused.
Reality
Two disclosed DoS techniques turn HTTP/3-to-HTTP/1.1 conversion at six major CDNs into up to 350x load on the origin, with no configuration change by the customer.
Reality
The vendor reports 10-plus CVEs and up to 200,000 exposed instances, and says Anthropic declined to change the protocol, describing the behaviour as expected.
Reality
CISA's advisory for its own network traffic analysis suite lists denial of service and arbitrary code execution: unbounded archive extraction, traversal in two layers, and uploads that run PHP as www-data.
Reality
CVE-2026-19478 needs no login and no click. CVE-2026-19650 needs a user to open a link. Self-managed operators on 18.11, 19.0, 19.1 and 19.2 have to patch anyway.
Reality
A dev.to post argues most "read-only" Kubernetes MCP servers filter the tools/list response while the write path stays callable. One such filter is now a CVE at CVSS 8.8.
Reality
CVE-2026-71368 affects F-RevoCRM 7.3.0 through 8.0.3 and runs attacker script inside the CRM's own origin. JVN rates it Medium; the published remedy is a version bump.
Reality
CVE-2026-69414 is an unpatched local escalation in the Malware Protection Engine, and it exists because the fix for CVE-2026-50656 was incomplete. Applying that earlier update bought nothing.
Reality
Huntress says a public proof of concept needs only an IP address to pull any file off unpatched Macs, driving a helper process that carries Full Disk Access.
Reality
Nine of eleven MCP marketplaces accepted proof-of-concept malware with zero review, and a fake agent skill cleared both Cisco's and NVIDIA's scanners to reach roughly 26,000 corporate agents.
Reality