https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-44428.htmlhttps://patchthecve.com/cve/CVE-2026-44428.htmlMon, 26 Oct 2026 14:10:00 +0000MEDIUM 4.7: The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client side, the publisher alwhttps://patchthecve.com/cve/CVE-2026-44430.htmlhttps://patchthecve.com/cve/CVE-2026-44430.htmlMon, 26 Oct 2026 14:10:00 +0000MEDIUM 4.0: The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace verification (POST /v0/auth/http, POST /v0.1/auth/http) uses safeDialContext (internal/api/handlers/v0/auth/http.go:67-110) to refuse dialling privhttps://patchthecve.com/cve/CVE-2026-44429.htmlhttps://patchthecve.com/cve/CVE-2026-44429.htmlMon, 26 Oct 2026 14:10:00 +0000MEDIUM 5.4: The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (file internal/api/handlers/v0/ui_index.html) is vulnerable to stored cross-site scripting via the server.websiteUrl field of any published ser