samanhappy vulnerabilities

CVEs per yearBy the year they were published

1. 20253
2. 202611

Newest CVEs

• CVE-2026-120323

  samanhappy MCPHub passthroughHeaders.ts information disclosure

  samanhappy · MCPHub

  Medium5.3
• CVE-2026-94047

  samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management

  samanhappy · MCPHub

  Medium5.3
• CVE-2026-90474

  MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass

  samanhappy · mcphub

  High7.6
• CVE-2026-79743

  MCPHub: Path Traversal via Malicious MCPB Manifest Name

  samanhappy · mcphub

  Medium6.9
• CVE-2026-79744

  MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration

  samanhappy · mcphub

  High8.8
• CVE-2026-79745

  MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)

  samanhappy · mcphub

  High7.1
• CVE-2026-79746

  MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching

  samanhappy · mcphub

  High8.1
• CVE-2026-79747

  MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)

  samanhappy · mcphub

  High7.1
• CVE-2026-79748

  MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)

  samanhappy · mcphub

  Critical9.9
• CVE-2026-79749

  MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation

  samanhappy · mcphub

  High7.6