[Git][security-tracker-team/security-tracker][master] Add three new python-mcp issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
65f280fb by Salvatore Bonaccorso at 2026-10-28T19:19:29+01:00
Add three new python-mcp issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -856,11 +856,26 @@ CVE-2026-116688 (CKEditor 5 is a modern JavaScript rich-text editor with an MVC
 CVE-2026-116687 (CKEditor 5 is a modern JavaScript rich-text editor with an MVC archite ...)
 	TODO: check
 CVE-2026-116686 (The Model Context Protocol Python SDK is the official Python SDK for M ...)
-	TODO: check
+	- python-mcp <unfixed>
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-rwrf-2pqf-9j8j
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/pull/3394
+	NOTE: Fixed by: https://github.com/modelcontextprotocol/python-sdk/commit/6705402e246dc4eb1fcdf4d9902b78d3c9c36e1b (v2.2.0)
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/pull/3396
+	NOTE: Fixed by: https://github.com/modelcontextprotocol/python-sdk/commit/5ebdfed4060d8e5b11b8e2348f86bad4d1fb8836 (v1.30.0)
 CVE-2026-116685 (The Model Context Protocol Python SDK is the official Python SDK for M ...)
-	TODO: check
+	- python-mcp <unfixed>
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-5h93-6whr-6q8j
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/pull/3397
+	NOTE: Fixed by: https://github.com/modelcontextprotocol/python-sdk/commit/c6762e821c527925f0b617db216d00fbd1d0bf99 (v2.2.0)
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/pull/3448
+	NOTE: Fixed by: https://github.com/modelcontextprotocol/python-sdk/commit/2106335745563b2321b8c73fef2c12903d00aa6e (v1.30.0)
 CVE-2026-116684 (The Model Context Protocol Python SDK is the official Python SDK for M ...)
-	TODO: check
+	- python-mcp <unfixed>
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/pull/3447
+	NOTE: Fixed by: https://github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c9789bda2f40 (v2.2.0)
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/pull/3451
+	NOTE: Fixed by: https://github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b58c2f512 (v1.30.0)
 CVE-2026-116613 (The Animated Text Block plugin for WordPress is vulnerable to Sensitiv ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-116610 (The Clean Login plugin for WordPress is vulnerable to Missing Authoriz ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/65f280fbc23fe7a941af54f0c0aef41faddf5977

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/65f280fbc23fe7a941af54f0c0aef41faddf5977
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261028/a3da92b4/attachment.htm>