https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T23:12:40.408024+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-09360 bdu:2025-09360 2026-10-05T23:12:40.410949+00:00 bdu:2025-09360 https://cve.radiocsirt.org/vuln/euvd-2026-246342 EUVD-2026-246342 2026-10-05T23:12:40.410982+00:00 EUVD-2026-246342 https://cve.radiocsirt.org/vuln/fkie_cve-2025-53110 fkie_cve-2025-53110 2026-10-05T23:12:40.410996+00:00

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 0.6.4 or 2025.7.01 resolve.

 https://cve.radiocsirt.org/vuln/ghsa-hc55-p739-j48w GHSA-hc55-p739-j48w — @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix 2026-10-05T23:12:40.411023+00:00

Affected: npm: @modelcontextprotocol/server-filesystem

Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 2025.7.1 to resolve the issue.

Thank you to Elad Beber (Cymulate) for reporting these issues.