mcphubx has 4 CVEs on record between 2025 and 2026. The median CVSS is 5.8 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.8
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Worst active — by depth score
CVE-2025-11287High· 7.3A vulnerability was identified in samanhappy MCPHub up to 0.9.1040CVE-2025-11285Medium· 6.3A vulnerability was found in samanhappy MCPHub up to 0.9.1036CVE-2025-13822Medium· 5.3MCPHub in versions below 0.11.0 is vulnerable to authentication bypass29CVE-2025-11286Medium· 4.7A vulnerability was determined in samanhappy MCPHub up to 0.9.1026
mcphubx vulnerabilities
CVEs affecting mcphubx, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2025-13822Medium· 5.3MCPHub in versions below 0.11.0 is vulnerable to authentication bypass
MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their pri…
CVE-2025-11287High· 7.3A vulnerability was identified in samanhappy MCPHub up to 0.9.10
A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnectionfunction of the file src/services/sseService.ts. Such manipulation leads to improper authentication. The attack …
CVE-2025-11286Medium· 4.7A vulnerability was determined in samanhappy MCPHub up to 0.9.10
A vulnerability was determined in samanhappy MCPHub up to 0.9.10. This affects an unknown part of the file src/controllers/serverController.ts of the component MCPRouter Service. This manipulation of the argument baseUrl causes server-si…
CVE-2025-11285Medium· 6.3A vulnerability was found in samanhappy MCPHub up to 0.9.10
A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController.ts. The manipulation of the argument command/args results in os command inject…