https://mcp-news.com/news/kotlin-sdk-streamable-http-dos-cve-pair MCP News en 2026-09-03 Kotlin SDK discloses two Streamable HTTP denial-of-service records, one unauthenticated, both fixed nine weeks earlier https://mcp-news.com/news/mcp-inspector-2-5-0-oauth-revocation MCP News en 2026-09-02 MCP Inspector 2.5.0 revokes OAuth tokens when you clear them, and stops retrying a subscription that was never acknowledged https://mcp-news.com/news/ssh-mcp-classifier-bypass-critical-advisory MCP News en 2026-09-02 ssh-mcp discloses a critical bypass of the gate that enforces its read-only mode, and groups it with four earlier ones as the same defect