jlowin has 4 CVEs on record between 2025 and 2026. The median CVSS is 7.2 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Weakness classes
Products
- fastmcp 4
Worst active — by depth score
CVE-2026-32871Critical· 10.0FastMCP is a Pythonic way to build MCP servers and clients55CVE-2025-62801High· 7.8FastMCP is the standard framework for building MCP applications43CVE-2025-69196Medium· 6.5FastMCP is the standard framework for building MCP applications36CVE-2025-62800Medium· 6.1FastMCP is the standard framework for building MCP applications34
jlowin vulnerabilities
CVEs affecting jlowin, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-32871Critical· 10.0FastMCP is a Pythonic way to build MCP servers and clients
FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for const…
CVE-2025-69196Medium· 6.5FastMCP is the standard framework for building MCP applications
FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the …
CVE-2025-62801High· 7.8FastMCP is the standard framework for building MCP applications
FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hos…
CVE-2025-62800Medium· 6.1FastMCP is the standard framework for building MCP applications
FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values ar…