# Lfprojects vulnerabilities Source: https://junglewise.ai/threats/vendors/lfprojects Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/lfprojects.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in Lfprojects: 0 in the last 7 days and 0 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-35568, was published on 7 April 2026. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 14 (3 critical, 0 exploited in the wild) ## About Lfprojects An open-source project maintainer on GitHub. ## Latest Lfprojects vulnerabilities - [CVE-2026-35568: Model Context Protocol Java SDK DNS rebinding in mcp-core](https://junglewise.ai/threats/cve-2026-35568-model-context-protocol-java-sdk-dns-rebinding-in-mcp-core) (medium, CVSS 5.7, published 7 Apr 2026) - [CVE-2026-34742: modelcontextprotocol go-sdk DNS rebinding in HTTP handlers](https://junglewise.ai/threats/cve-2026-34742-modelcontextprotocol-go-sdk-dns-rebinding-in-http-handlers) (high, CVSS 8.1, published 2 Apr 2026) - [CVE-2026-33946: MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay](https://junglewise.ai/threats/cve-2026-33946-mcp-ruby-sdk-insufficient-session-binding-allows-sse-stream) (medium, CVSS 5.9, published 27 Mar 2026) - [CVE-2026-27896: Model Context Protocol Go SDK improper case sensitivity in JSON-RPC parsing](https://junglewise.ai/threats/cve-2026-27896-model-context-protocol-go-sdk-improper-case-sensitivity-in-json) (high, CVSS 7.5, published 26 Feb 2026) - [CVE-2026-27623: Valkey denial of service via reachable assertion in RESP processing](https://junglewise.ai/threats/cve-2026-27623-valkey-denial-of-service-via-reachable-assertion-in-resp) (high, CVSS 7.5, published 23 Feb 2026) - [CVE-2026-25536: Model Context Protocol TypeScript SDK data leak in McpServer transport](https://junglewise.ai/threats/cve-2026-25536-model-context-protocol-typescript-sdk-data-leak-in-mcpserver) (high, CVSS 7.1, published 4 Feb 2026) - [CVE-2026-0621: Anthropic MCP TypeScript SDK ReDoS in UriTemplate](https://junglewise.ai/threats/cve-2026-0621-anthropic-mcp-typescript-sdk-redos-in-uritemplate) (high, CVSS 7.5, published 5 Jan 2026) - [CVE-2025-68145: PYSEC-2026-1623 - mcp-server-git has missing path validation when using --repository flag](https://junglewise.ai/threats/cve-2025-68145-mcp-server-git-has-missing-path-validation-when-using-repository) (critical, CVSS 9.1, published 17 Dec 2025) - [CVE-2025-68143: PYSEC-2026-1621 - mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations](https://junglewise.ai/threats/cve-2025-68143-mcp-server-git-s-unrestricted-git-init-tool-allows-repository) (high, CVSS 8.8, published 17 Dec 2025) - [CVE-2025-66416: Model Context Protocol Python SDK DNS rebinding in HTTP servers](https://junglewise.ai/threats/cve-2025-66416-model-context-protocol-python-sdk-dns-rebinding-in-http-servers) (high, CVSS 8.1, published 2 Dec 2025) - [CVE-2025-66414: Anthropic MCP TypeScript SDK DNS rebinding bypass on localhost](https://junglewise.ai/threats/cve-2025-66414-anthropic-mcp-typescript-sdk-dns-rebinding-bypass-on-localhost) (high, CVSS 8.1, published 2 Dec 2025) - [CVE-2025-65105: GO-2025-4176 - Apptainer ineffectively applies selinux and apparmor --security options in github.com/apptainer/apptainer](https://junglewise.ai/threats/cve-2025-65105-apptainer-ineffectively-applies-selinux-and-apparmor-security) (medium, CVSS 4.5, published 2 Dec 2025) - [CVE-2025-11201: PYSEC-2026-1640 - MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2025-11201-mlflow-tracking-server-model-creation-directory-traversal-remote) (critical, CVSS 9.8, published 29 Oct 2025) - [CVE-2025-11200: PYSEC-2026-1642 - MLflow Weak Password Requirements Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2025-11200-mlflow-weak-password-requirements-authentication-bypass) (critical, CVSS 9.8, published 29 Oct 2025) ## Most severe Lfprojects vulnerabilities - [CVE-2025-11201: PYSEC-2026-1640 - MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2025-11201-mlflow-tracking-server-model-creation-directory-traversal-remote) (critical, CVSS 9.8, published 29 Oct 2025) - [CVE-2025-11200: PYSEC-2026-1642 - MLflow Weak Password Requirements Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2025-11200-mlflow-weak-password-requirements-authentication-bypass) (critical, CVSS 9.8, published 29 Oct 2025) - [CVE-2025-68145: PYSEC-2026-1623 - mcp-server-git has missing path validation when using --repository flag](https://junglewise.ai/threats/cve-2025-68145-mcp-server-git-has-missing-path-validation-when-using-repository) (critical, CVSS 9.1, published 17 Dec 2025) - [CVE-2025-68143: PYSEC-2026-1621 - mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations](https://junglewise.ai/threats/cve-2025-68143-mcp-server-git-s-unrestricted-git-init-tool-allows-repository) (high, CVSS 8.8, published 17 Dec 2025) - [CVE-2026-34742: modelcontextprotocol go-sdk DNS rebinding in HTTP handlers](https://junglewise.ai/threats/cve-2026-34742-modelcontextprotocol-go-sdk-dns-rebinding-in-http-handlers) (high, CVSS 8.1, published 2 Apr 2026) - [CVE-2025-66416: Model Context Protocol Python SDK DNS rebinding in HTTP servers](https://junglewise.ai/threats/cve-2025-66416-model-context-protocol-python-sdk-dns-rebinding-in-http-servers) (high, CVSS 8.1, published 2 Dec 2025) - [CVE-2025-66414: Anthropic MCP TypeScript SDK DNS rebinding bypass on localhost](https://junglewise.ai/threats/cve-2025-66414-anthropic-mcp-typescript-sdk-dns-rebinding-bypass-on-localhost) (high, CVSS 8.1, published 2 Dec 2025) - [CVE-2026-27896: Model Context Protocol Go SDK improper case sensitivity in JSON-RPC parsing](https://junglewise.ai/threats/cve-2026-27896-model-context-protocol-go-sdk-improper-case-sensitivity-in-json) (high, CVSS 7.5, published 26 Feb 2026) - [CVE-2026-0621: Anthropic MCP TypeScript SDK ReDoS in UriTemplate](https://junglewise.ai/threats/cve-2026-0621-anthropic-mcp-typescript-sdk-redos-in-uritemplate) (high, CVSS 7.5, published 5 Jan 2026) - [CVE-2026-27623: Valkey denial of service via reachable assertion in RESP processing](https://junglewise.ai/threats/cve-2026-27623-valkey-denial-of-service-via-reachable-assertion-in-resp) (high, CVSS 7.5, published 23 Feb 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Lfprojects technologies - [Lfprojects Valkey](https://junglewise.ai/threats/technologies/valkey): 9 vulnerabilities - [Lfprojects Mcp Typescript Sdk](https://junglewise.ai/threats/technologies/mcp-typescript-sdk): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Lfprojects vulnerabilities", https://junglewise.ai/threats/vendors/lfprojects, 9 November 2026.