{"items":[{"id":"CVE-2026-35568","published":"2026-04-07T21:06:10.438Z","updated":"2026-04-08T15:43:22.962Z","title":"MCP Java-SDK has a DNS Rebinding Vulnerability","severity":"HIGH","score":7.6,"vendor":"modelcontextprotocol","product":"java-sdk","kev":false,"epss":0.00143,"kevAdded":null,"exploit":false},{"id":"CVE-2026-34237","published":"2026-03-31T15:40:01.070Z","updated":"2026-06-09T18:39:37.473Z","title":"MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)","severity":"MEDIUM","score":6.1,"vendor":"modelcontextprotocol","product":"java-sdk","kev":false,"epss":0.00231,"kevAdded":null,"exploit":false}]}