https://mcp-news.com/news/rmcp-3-1-4-hardens-request-state-signing MCP News en 2026-08-20 rmcp 3.1.4 requires 32-byte signing keys for MRTR request state and stops Debug from printing OAuth secrets https://mcp-news.com/news/contentful-mcp-export-space-pat-redirect MCP News en 2026-08-19 Contentful MCP Server advisory: two migration tools let a model redirect the server's access token to any host https://mcp-news.com/news/github-mcp-server-1-10-0-security-release MCP News en 2026-08-19 GitHub MCP Server 1.10.0 gates repository deletion behind elicitation and hardens credentials, symlinks and request limits https://mcp-news.com/news/java-sdk-bounds-unbounded-http-reads MCP News en 2026-08-19 Official Java SDK caps HTTP reads in both directions after two resource-exhaustion advisories https://mcp-news.com/news/marimo-notebook-mcp-entry-code-injection MCP News en 2026-08-19 CVE record published for a marimo flaw where a notebook's own MCP server entry ran as a subprocess on open https://mcp-news.com/news/mcp-inspector-2-3-0-oauth-overrides MCP News en 2026-08-19 MCP Inspector 2.3.0 adds per-server OAuth overrides and clears eight dependency advisories https://mcp-news.com/news/searxng-mcp-three-advisories MCP News en 2026-08-19 Three advisories published for the SearXNG MCP server, including basic-auth credentials leaking through MCP logs and JSON-RPC errors https://mcp-news.com/news/splunk-mcp-server-app-deserialization-rce MCP News en 2026-08-19 Splunk discloses command execution in its MCP Server app through unchecked deserialization in credential management https://mcp-news.com/news/apify-actors-mcp-token-leak-cve-reaches-nvd MCP News en 2026-08-18 CVE record published for an Apify MCP server flaw that could redirect a client's bearer token to a third-party host https://mcp-news.com/news/context7-custom-instructions-prompt-injection-cve MCP News en 2026-08-18 CVE record published for the Context7 custom-rules prompt injection Upstash fixed in February https://mcp-news.com/news/apache-skywalking-mcp-ssrf-graphql-injection-cve MCP News en 2026-08-18 CVE record published for the Apache SkyWalking MCP SSRF and GraphQL injection fixed in April https://mcp-news.com/news/codewhale-approval-requirement-bypass-cves MCP News en 2026-08-18 Two CodeWhale CVEs record tools that declared themselves auto-approved and overrode the user's approval policy