Unverified50% confidenceFactExact time
Traceforce's open-source scanner MCP X-Ray has already discovered five MCP server vulnerabilities, all of which have been assigned CVE numbers.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/16/2026
First Seen
Valid until: 1/14/2027
Sources
Silicon Valley AI Security Startup Traceforce Is Hiring a Backend Engineer in Seoul
youtube경영컨설팅 서비스 파파토니 PAPATONY10/16/2026
Related Entities
Related Claims
UnverifiedSecurity researchers have discovered the first malicious MCP server found being used in the wild.63% similarUnverifiedA single compromised MCP server can execute prompt injection, credential exfiltration, delivery of phishing toolkit fingerprints, PII leakage, token theft via OAuth, and SSRF attacks.60% similarUnverifiedPerforce disclosed the CVE-2026-109758 vulnerability, which involves issues with default tokens and a PATCH path parser in its SCIM implementation.59% similarUnverifiedDisclosed MCP vulnerabilities include: argocd-mcp shipped with no authentication at all, Rill's OAuth flow allowed attackers to skip the user consent step, and prompt injection existed in the tool descriptions of multiple MCP servers.59% similarUnverifiedA developer posted a free offline scanning tool on Reddit for detecting 53 CVE vulnerability code patterns across 9 mainstream Agent frameworks.59% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1044325API
curl https://kongchang.com/api/v1/knowledge/claims/1044325MCP
get_claim(id=1044325)