https://mcp-news.com/news/apify-actors-mcp-token-leak-cve-reaches-nvd MCP News en 2026-08-18 CVE record published for an Apify MCP server flaw that could redirect a client's bearer token to a third-party host https://mcp-news.com/news/context7-custom-instructions-prompt-injection-cve MCP News en 2026-08-18 CVE record published for the Context7 custom-rules prompt injection Upstash fixed in February https://mcp-news.com/news/chrome-devtools-mcp-roots-symlink-bypass MCP News en 2026-08-17 Advisory published for a roots boundary bypass in Google's Chrome DevTools MCP server, fixed three months earlier https://mcp-news.com/news/onyx-cross-user-oauth-token-leak-mcp-endpoints MCP News en 2026-08-17 CVE record published for a critical cross-user OAuth token leak in Onyx's MCP server endpoints https://mcp-news.com/news/pycharm-unauthenticated-jupyter-mcp-tools MCP News en 2026-08-17 JetBrains discloses code execution via unauthenticated Jupyter MCP tools in PyCharm before 2026.2.1 https://mcp-news.com/news/siyuan-mcp-database-clean-path-traversal MCP News en 2026-08-17 CVE record published for path traversal in SiYuan's database_clean MCP tool, a hardening gap the HTTP API had already closed