Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestions search

All statuses
Filter by:
With package: gitea-mcp-server

Found 4 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-94044
5.5 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
created 2 hours ago Activity log
  • Created suggestion 2 hours ago
03-lovepreetSingh MCP route.ts create_file path traversal

A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546. This issue affects the function create_file of the file app/api/mcp/route.ts. Such manipulation of the argument filePath/content leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

MCP
  • ==f95d035c5317fad81af9828286631053ccb23546

Matching in nixpkgs

pkgs.mcpp

Matsui's C preprocessor

  • nixos-unstable -
  • nixos-26.05 -

pkgs.ha-mcp

MCP server for controlling Home Assistant via natural language

  • nixos-unstable -
    • nixos-unstable-small 8.4.3
  • nixos-26.05 -
    • nixos-26.05-small 7.4.1

pkgs.numcpp

Templatized Header Only C++ Implementation of the Python NumPy Library

  • nixos-unstable -
  • nixos-26.05 -

pkgs.fff-mcp

MCP server for the fff file search engine

  • nixos-unstable -

pkgs.pdf-mcp

MCP server that lets AI agents work through large PDFs without overflowing their context

  • nixos-unstable -

pkgs.libXdmcp

X Display Manager Control Protocol library

  • nixos-unstable -
    • nixos-unstable-small 1.1.5
  • nixos-26.05 -
    • nixos-26.05-small 1.1.5

pkgs.libxdmcp

X Display Manager Control Protocol library

  • nixos-unstable -
    • nixos-unstable-small 1.1.5
  • nixos-26.05 -
    • nixos-26.05-small 1.1.5

pkgs.mcp-reva

Headless MCP server exposing Ghidra to AI agents

  • nixos-unstable -
    • nixos-unstable-small 7.3.0

pkgs.mcporter

TypeScript runtime and CLI for connecting to configured Model Context Protocol servers

  • nixos-unstable -
  • nixos-26.05 -

pkgs.mymcplus

PlayStation 2 memory card manager

  • nixos-unstable -
    • nixos-unstable-small 3.0.5
  • nixos-26.05 -
    • nixos-26.05-small 3.0.5

pkgs.azure-mcp

Model Context Protocol server for Azure services

pkgs.mcp-nixos

MCP server for NixOS

  • nixos-unstable -
    • nixos-unstable-small 3.0.1
  • nixos-26.05 -
    • nixos-26.05-small 2.4.3

pkgs.mcp-proxy

MCP server which proxies other MCP servers from stdio to SSE or from SSE to stdio

  • nixos-unstable -
  • nixos-26.05 -

pkgs.mcp-k8s-go

MCP server connecting to Kubernetes

  • nixos-unstable -
    • nixos-unstable-small 0.6.0
  • nixos-26.05 -
    • nixos-26.05-small 0.6.0

pkgs.forgejo-mcp

Model Context Protocol (MCP) server for interacting with the Forgejo REST API

  • nixos-unstable -
  • nixos-26.05 -

pkgs.mcp-gateway

Universal MCP Gateway - Single-port multiplexing with Meta-MCP for ~95% context token savings

  • nixos-unstable -
    • nixos-unstable-small 3.5.1
  • nixos-26.05 -

pkgs.mcp-grafana

MCP server for Grafana

  • nixos-unstable -
    • nixos-unstable-small 1.2.0
  • nixos-26.05 -

pkgs.mcp-searxng

Private web search for AI assistants via SearXNG — supports Claude, Cursor, and any MCP client

  • nixos-unstable -
    • nixos-unstable-small 2.3.0

pkgs.buttplug-mcp

Buttplug.io Model Context Protocol (MCP) Server

  • nixos-unstable -
    • nixos-unstable-small 0.0.1
  • nixos-26.05 -
    • nixos-26.05-small 0.0.1

pkgs.context7-mcp

MCP Server for up-to-date code documentation for LLMs and AI code editors

  • nixos-unstable -
    • nixos-unstable-small 4.0.3
  • nixos-26.05 -
    • nixos-26.05-small 2.2.5

pkgs.lean-lsp-mcp

MCP server for the Lean theorem prover via the Lean LSP

  • nixos-unstable -
  • nixos-26.05 -

pkgs.firecrawl-mcp

A Model Context Protocol (MCP) server that brings Firecrawl to MCP-compatible AI agents

  • nixos-unstable -

pkgs.norgolith-mcp

MCP (Model Context Protocol) server for Norgolith documentation

  • nixos-unstable -
    • nixos-unstable-small 1.2.0

pkgs.aks-mcp-server

Model Context Protocol server for Azure Kubernetes Service

  • nixos-unstable -
  • nixos-26.05 -

pkgs.markitdown-mcp

MCP server for the markitdown library

  • nixos-unstable -
    • nixos-unstable-small 0.1.5
  • nixos-26.05 -
    • nixos-26.05-small 0.1.5

pkgs.mcp-server-git

Model Context Protocol server providing tools to read, search, and manipulate Git repositories programmatically via LLMs

  • nixos-unstable -
  • nixos-26.05 -

pkgs.mcp-server-time

Model Context Protocol server providing tools for time queries and timezone conversions for LLMs

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-mcp

MCP server for Thunderbird - enables AI assistants to access email, contacts, and calendars

  • nixos-unstable -
    • nixos-unstable-small 0.7.4
  • nixos-26.05 -
    • nixos-26.05-small 0.5.0

pkgs.gitea-mcp-server

Gitea Model Context Protocol (MCP) Server

  • nixos-unstable -
    • nixos-unstable-small 1.6.0
  • nixos-26.05 -
    • nixos-26.05-small 1.3.0

pkgs.clojure-mcp-light

Simple Clojure tooling for AI coding assistants

  • nixos-unstable -
    • nixos-unstable-small 0.2.2

pkgs.mcp-server-memory

MCP server for enabling memory for Claude through a knowledge graph

  • nixos-unstable -
  • nixos-26.05 -

pkgs.codebase-memory-mcp

High-performance C11 MCP server that indexes codebases into a persistent knowledge graph

  • nixos-unstable -

pkgs.fluxcd-operator-mcp

Kubernetes controller for managing the lifecycle of Flux CD

  • nixos-unstable -
  • nixos-26.05 -

pkgs.haskellPackages.mcp

A Servant-based Model Context Protocol (MCP) server for Haskell

  • nixos-unstable -
  • nixos-26.05 -

pkgs.mcp-language-server

Model Context Protocol server to interact with language servers

  • nixos-unstable -
    • nixos-unstable-small 0.1.1
  • nixos-26.05 -
    • nixos-26.05-small 0.1.1

pkgs.thunderbird-cli-mcp

MCP server that gives full access to your email through Mozilla Thunderbird

  • nixos-unstable -
    • nixos-unstable-small 1.0.2
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.firefox-devtools-mcp

Model Context Protocol server for Firefox DevTools automation

  • nixos-unstable -
    • nixos-unstable-small 0.9.9

pkgs.terraform-mcp-server

Terraform Model Context Protocol (MCP) Server

  • nixos-unstable -
    • nixos-unstable-small 1.3.0
  • nixos-26.05 -
    • nixos-26.05-small 0.5.2

pkgs.python313Packages.mcp

Official Python SDK for Model Context Protocol servers and clients

  • nixos-unstable -
  • nixos-26.05 -

pkgs.python314Packages.mcp

Official Python SDK for Model Context Protocol servers and clients

  • nixos-unstable -
  • nixos-26.05 -

pkgs.haskellPackages.mcp-types

Core types and protocol definitions for the Model Context Protocol (MCP)

  • nixos-unstable -
    • nixos-unstable-small 0.1.1
  • nixos-26.05 -
    • nixos-26.05-small 0.1.1

pkgs.python313Packages.fastapi-mcp

Expose your FastAPI endpoints as Model Context Protocol (MCP) tools, with Auth

  • nixos-unstable -
    • nixos-unstable-small 0.4.0
  • nixos-26.05 -
    • nixos-26.05-small 0.4.0

pkgs.python314Packages.fastapi-mcp

Expose your FastAPI endpoints as Model Context Protocol (MCP) tools, with Auth

  • nixos-unstable -
    • nixos-unstable-small 0.4.0
  • nixos-26.05 -
    • nixos-26.05-small 0.4.0

Package maintainers

Untriaged
Permalink CVE-2026-53957
7.7 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 5 days, 2 hours ago Activity log
  • Created suggestion 5 days, 2 hours ago
Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, export_space and import_space in packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts and packages/mcp-tools/src/tools/jobs/space-to-space-migration/importSpace.ts expose host, proxy, rawProxy, and insecure network options to LLM-controlled tool arguments and combine those options with the server's CONTENTFUL_MANAGEMENT_TOKEN. After space_to_space_migration_handler enables the migration tools, a direct MCP call or prompt injection through attacker-controlled Contentful content can redirect Contentful Management API requests and their Authorization header to an attacker-controlled host or proxy. The regular tools that use createToolClient are unaffected because those tools pin the host from server configuration. Exposure of the personal access token permits persistent out-of-band access to every Contentful space within the token's scope. This issue is fixed in @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5.

Affected products

mcp-tools
  • ==< 0.4.5
mcp-server
  • ==< 1.7.19
contentful-mcp-server
  • ==< 1.7.19

Matching in nixpkgs

pkgs.aks-mcp-server

Model Context Protocol server for Azure Kubernetes Service

  • nixos-unstable -
  • nixos-26.05 -

pkgs.mcp-server-git

Model Context Protocol server providing tools to read, search, and manipulate Git repositories programmatically via LLMs

  • nixos-unstable -
  • nixos-26.05 -

pkgs.mcp-server-time

Model Context Protocol server providing tools for time queries and timezone conversions for LLMs

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitea-mcp-server

Gitea Model Context Protocol (MCP) Server

  • nixos-unstable -
    • nixos-unstable-small 1.6.0
  • nixos-26.05 -
    • nixos-26.05-small 1.3.0

pkgs.mcp-server-memory

MCP server for enabling memory for Claude through a knowledge graph

  • nixos-unstable -
  • nixos-26.05 -

pkgs.terraform-mcp-server

Terraform Model Context Protocol (MCP) Server

  • nixos-unstable -
    • nixos-unstable-small 1.3.0
  • nixos-26.05 -
    • nixos-26.05-small 0.5.2

Package maintainers

Untriaged
Permalink CVE-2026-60004
9.8 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 3 weeks, 4 days ago Activity log
  • Created suggestion 3 weeks, 4 days ago
Gitea before 1.27.1 allows remote code execution via the diffpatch …

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Affected products

Gitea
  • <1.27.1

Matching in nixpkgs

pkgs.gitea

Git with a cup of tea

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitea-mcp-server

Gitea Model Context Protocol (MCP) Server

  • nixos-unstable -
    • nixos-unstable-small 1.6.0
  • nixos-26.05 -
    • nixos-26.05-small 1.3.0

Package maintainers

Untriaged
Permalink CVE-2026-34966
8.3 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): High (H)
  • Subsequent System Impact Integrity (SI): Low (L)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): High (H)
  • Modified Subsequent System Impact Integrity (MSI): Low (L)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 1 month, 2 weeks ago Activity log
  • Created suggestion 1 month, 2 weeks ago
Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.

Affected products

Gitea
  • =<1.26.4
  • ==1.27.0

Matching in nixpkgs

pkgs.gitea

Git with a cup of tea

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitea-mcp-server

Gitea Model Context Protocol (MCP) Server

  • nixos-unstable -
    • nixos-unstable-small 1.6.0
  • nixos-26.05 -
    • nixos-26.05-small 1.3.0

Package maintainers