rust-sdk

Every one of the 4 is a mark on the map. Named now: 1 to 4, most at risk first.

1. RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-serviceCVE-2026-63128modelcontextprotocol · CVSS 7.5 · 0.5% likely

   CWE-400

2. RMCP: Custom HTTP headers leak to cross-origin redirect targetsCVE-2026-64684modelcontextprotocol · CVSS 6.8 · 0.5% likely

   CWE-200

3. RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transportCVE-2026-42559modelcontextprotocol · CVSS 8.8 · 0.3% likely

   CWE-346

4. RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata DiscoveryCVE-2026-63127modelcontextprotocol · CVSS 8.2 · 0.2% likely

   CWE-345

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.