VulnSea

The-40-Thieves has 7 CVEs on record. Disclosure cadence is accelerating: 7 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 7. The median CVSS is 7.1 (high), with 1 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-863 (5).

CVEs per month

Last 12 months, by publish date

120102030405060708091011
Exploited share
0% vs 1% corpus
Median CVSS
7.1
Publish → KEV
—
Last 90 days
7 prev 0

Products

  • obsidian-tc 7
Follow The-40-Thieves:RSS feedSave a search →Embed badge ↗
7
Total CVEs
1
Critical
0
CISA KEV
0
Exploited

Worst active — by depth score

The-40-Thieves vulnerabilities

CVEs affecting The-40-Thieves, newest first. Open any entry for full detail, references, and exploit status.

7 CVEsRSS

CVE-2026-115478High· 7.1
1w ago

obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLi…

▾ TwilightThe-40-Thieves · obsidian-tcEPSS 0.32%via CVEORG
CVE-2026-115477High· 7.1PoC
1w ago

obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configured and a 2026-07-28-era client declaring `elicitation.form`…

▾ MidnightThe-40-Thieves · obsidian-tcEPSS 0.35%via CVEORG
CVE-2026-77362Medium· 4.3
3w ago

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes gr…

▾ SunlitThe-40-Thieves · obsidian-tcEPSS 0.20%via NVD
CVE-2026-77361Medium· 4.7
3w ago

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault…

▾ SunlitThe-40-Thieves · obsidian-tcEPSS 0.11%via NVD
CVE-2026-77366Critical· 9.9
3w ago

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT)…

▾ MidnightThe-40-Thieves · obsidian-tcEPSS 0.31%via NVD
CVE-2026-77364Medium· 6.5
3w ago

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian,…

▾ SunlitThe-40-Thieves · obsidian-tcEPSS 0.24%via NVD
CVE-2026-77363High· 8.8
3w ago

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented l…

▾ TwilightThe-40-Thieves · obsidian-tcEPSS 0.15%via NVD
The-40-Thieves vulnerabilities (CVEs) · VulnSea