Go to main page
Versions in this module
v1
Jul 12, 2026
May 12, 2026
May 5, 2026 GO-2026-5008
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
May 4, 2026 GO-2026-5008
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
Apr 30, 2026 GO-2026-5008 +2 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
Apr 29, 2026 GO-2026-5008 +3 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
Apr 29, 2026 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Apr 28, 2026 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Apr 27, 2026 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Apr 27, 2026 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Apr 25, 2026 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Apr 15, 2026 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Mar 6, 2026 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Feb 10, 2026 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Dec 13, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Nov 18, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Nov 17, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Nov 3, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Oct 29, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Oct 29, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Oct 24, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Oct 24, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Oct 16, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Oct 16, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Oct 15, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
Oct 14, 2025 GO-2026-5008 +4 more
GO-2026-5008: MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry
GO-2026-5273: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
GO-2026-5607: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
GO-2026-5637: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` in github.com/modelcontextprotocol/registry
GO-2026-5658: MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry