Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs
A high-severity flaw in Amazon Q Developer could allow a malicious repository to execute commands and steal a developer's cloud credentials. The…
Tag: MCP
CVE-2025-59536: Claude Code MCP Config Command Execution
A vulnerability in Claude Code allowed project-level MCP configuration to lead to command execution.
CVE-2026-30615: Windsurf MCP Config Rewrite Command Execution
A vulnerability in Windsurf allowed attacker-controlled content to rewrite local MCP config and register a malicious server, leading to command execution.
Amazon Q Developer Flaw Allows Code Execution via MCP Configs
A flaw in Amazon Q Developer could let malicious repositories run code through MCP configurations.
Intezer Analyzes Kiro MCP Configuration Flaw
Intezer analyzed a vulnerability in Amazon Kiro that allowed attackers to rewrite MCP server configuration files and achieve arbitrary code execution via…
Sentry Error Tracking Platform Exploited in Agentjacking Attack
Sentry, an open-source error-tracking and performance-monitoring platform, was exploited in the Agentjacking attack due to its event ingestion and MCP server.
Microsoft Visual Studio Code MCP Install Dialog Flaw
Microsoft Visual Studio Code has a vulnerability (CVE-2026-41613) in its MCP install dialog that allows code execution via crafted deeplinks.