https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-11T03:07:28.554048+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-108586 fkie_cve-2026-108586 2026-10-11T03:07:29.065777+00:00

1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not <granted-tag> to list and invoke tools on backend MCP servers outside their granted scopes.

 https://vulnerability.circl.lu/vuln/ghsa-w2j7-xxh9-9q67 GHSA-w2j7-xxh9-9q67 2026-10-11T03:07:29.065991+00:00

1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not <granted-tag> to list and invoke tools on backend MCP servers outside their granted scopes.