{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-33010", "tracking": { "current_release_date": "2026-03-22T04:41:07.199613Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-33010", "initial_release_date": "2026-03-18T23:09:17.337363Z", "revision_history": [ { "date": "2026-03-18T23:09:17.337363Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-03-18T23:09:31.341508Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-03-19T00:41:40.241308Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (181).| Product Identifiers created (187).| Products created (7).| References created (1).| CWES updated (1)." }, { "date": "2026-03-19T00:41:58.466486Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-03-19T15:29:09.022136Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-03-20T19:26:58.416984Z", "number": "6", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)." }, { "date": "2026-03-20T19:27:08.362554Z", "number": "7", "summary": "NCSC Score updated." }, { "date": "2026-03-20T19:38:54.699184Z", "number": "8", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (1).| CWES updated (1)." }, { "date": "2026-03-20T19:38:56.934724Z", "number": "9", "summary": "NCSC Score updated." }, { "date": "2026-03-20T21:43:37.596152Z", "number": "10", "summary": "References created (1)." }, { "date": "2026-03-20T23:38:50.056391Z", "number": "11", "summary": "Unknown change." }, { "date": "2026-03-21T13:46:43.882084Z", "number": "12", "summary": "References removed (1)." }, { "date": "2026-03-21T15:23:32.722755Z", "number": "13", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-21T15:23:46.189856Z", "number": "14", "summary": "NCSC Score updated." }, { "date": "2026-03-22T04:40:59.319250Z", "number": "15", "summary": "NCSC Score updated." } ], "status": "interim", "version": "15" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/10.0.0", "product": { "name": "vers:unknown/10.0.0", "product_id": "CSAFPID-5764922", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.0.1", "product": { "name": "vers:unknown/10.0.1", "product_id": "CSAFPID-5764923", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.0.1" } } }, { "category": "product_version_range", "name": "vers:unknown/10.0.2", "product": { "name": "vers:unknown/10.0.2", "product_id": "CSAFPID-5764924", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.0.2" } } }, { "category": "product_version_range", "name": "vers:unknown/10.0.3", "product": { "name": "vers:unknown/10.0.3", "product_id": "CSAFPID-5764925", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.0.3" } } }, { "category": "product_version_range", "name": "vers:unknown/10.1.0", "product": { "name": "vers:unknown/10.1.0", "product_id": "CSAFPID-5764926", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.1.1", "product": { "name": "vers:unknown/10.1.1", "product_id": "CSAFPID-5764927", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/10.1.2", "product": { "name": "vers:unknown/10.1.2", "product_id": "CSAFPID-5764928", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.1.2" } } }, { "category": "product_version_range", "name": "vers:unknown/10.10.0", "product": { "name": "vers:unknown/10.10.0", "product_id": "CSAFPID-5764929", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.10.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.10.1", "product": { "name": "vers:unknown/10.10.1", "product_id": "CSAFPID-5764930", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.10.1" } } }, { "category": "product_version_range", "name": "vers:unknown/10.10.2", "product": { "name": "vers:unknown/10.10.2", "product_id": "CSAFPID-5764931", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.10.2" } } }, { "category": "product_version_range", "name": "vers:unknown/10.10.3", "product": { "name": "vers:unknown/10.10.3", "product_id": "CSAFPID-5764932", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.10.3" } } }, { "category": "product_version_range", "name": "vers:unknown/10.10.4", "product": { "name": "vers:unknown/10.10.4", "product_id": "CSAFPID-5764933", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.10.4" } } }, { "category": "product_version_range", "name": "vers:unknown/10.10.5", "product": { "name": "vers:unknown/10.10.5", "product_id": "CSAFPID-5764934", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.10.5" } } }, { "category": "product_version_range", "name": "vers:unknown/10.10.6", "product": { "name": "vers:unknown/10.10.6", "product_id": "CSAFPID-5764935", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.10.6" } } }, { "category": "product_version_range", "name": "vers:unknown/10.11.0", "product": { "name": "vers:unknown/10.11.0", "product_id": "CSAFPID-5764936", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.11.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.11.1", "product": { "name": "vers:unknown/10.11.1", "product_id": "CSAFPID-5764937", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.11.1" } } }, { "category": "product_version_range", "name": "vers:unknown/10.11.2", "product": { "name": "vers:unknown/10.11.2", "product_id": "CSAFPID-5764938", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.11.2" } } }, { "category": "product_version_range", "name": "vers:unknown/10.12.0", "product": { "name": "vers:unknown/10.12.0", "product_id": "CSAFPID-5764939", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.12.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.12.1", "product": { "name": "vers:unknown/10.12.1", "product_id": "CSAFPID-5764940", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.12.1" } } }, { "category": "product_version_range", "name": "vers:unknown/10.13.0", "product": { "name": "vers:unknown/10.13.0", "product_id": "CSAFPID-5764941", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.13.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.13.1", "product": { "name": "vers:unknown/10.13.1", "product_id": "CSAFPID-5764942", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.13.1" } } }, { "category": "product_version_range", "name": "vers:unknown/10.13.2", "product": { "name": "vers:unknown/10.13.2", "product_id": "CSAFPID-5764943", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.13.2" } } }, { "category": "product_version_range", "name": "vers:unknown/10.14.0", "product": { "name": "vers:unknown/10.14.0", "product_id": "CSAFPID-5764944", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.14.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.15.0", "product": { "name": "vers:unknown/10.15.0", "product_id": "CSAFPID-5764945", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.15.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.15.1", "product": { "name": "vers:unknown/10.15.1", "product_id": "CSAFPID-5764946", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.15.1" } } }, { "category": "product_version_range", "name": "vers:unknown/10.16.0", "product": { "name": "vers:unknown/10.16.0", "product_id": "CSAFPID-5764947", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.16.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.16.1", "product": { "name": "vers:unknown/10.16.1", "product_id": "CSAFPID-5764948", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.16.1" } } }, { "category": "product_version_range", "name": "vers:unknown/10.17.0", "product": { "name": "vers:unknown/10.17.0", "product_id": "CSAFPID-5764949", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.17.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.17.10", "product": { "name": "vers:unknown/10.17.10", "product_id": "CSAFPID-5764950", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.17.10" } } }, { "category": "product_version_range", "name": "vers:unknown/10.17.12", "product": { "name": "vers:unknown/10.17.12", "product_id": "CSAFPID-5764951", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.17.12" } } }, { "category": "product_version_range", "name": "vers:unknown/10.17.13", "product": { "name": "vers:unknown/10.17.13", "product_id": "CSAFPID-5764952", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.17.13" } } }, { "category": "product_version_range", "name": "vers:unknown/10.17.14", "product": { "name": "vers:unknown/10.17.14", "product_id": "CSAFPID-5764953", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.17.14" } } }, { "category": "product_version_range", "name": "vers:unknown/10.17.15", "product": { "name": "vers:unknown/10.17.15", "product_id": "CSAFPID-5764954", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.17.15" } } }, { "category": "product_version_range", "name": "vers:unknown/10.17.16", "product": { "name": "vers:unknown/10.17.16", "product_id": "CSAFPID-5764955", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.17.16" } } }, { "category": "product_version_range", "name": "vers:unknown/10.17.2", "product": { "name": "vers:unknown/10.17.2", "product_id": "CSAFPID-5764956", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.17.2" } } }, { "category": "product_version_range", "name": "vers:unknown/10.17.3", "product": { "name": "vers:unknown/10.17.3", "product_id": "CSAFPID-5764957", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.17.3" } } }, { "category": "product_version_range", "name": "vers:unknown/10.17.4", "product": { "name": "vers:unknown/10.17.4", "product_id": "CSAFPID-5764958", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.17.4" } } }, { "category": "product_version_range", "name": "vers:unknown/10.17.5", "product": { "name": "vers:unknown/10.17.5", "product_id": "CSAFPID-5764959", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.17.5" } } }, { "category": "product_version_range", "name": "vers:unknown/10.17.6", "product": { "name": "vers:unknown/10.17.6", "product_id": "CSAFPID-5764960", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.17.6" } } }, { "category": "product_version_range", "name": "vers:unknown/10.17.7", "product": { "name": "vers:unknown/10.17.7", "product_id": "CSAFPID-5764961", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.17.7" } } }, { "category": "product_version_range", "name": "vers:unknown/10.17.8", "product": { "name": "vers:unknown/10.17.8", "product_id": "CSAFPID-5764962", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.17.8" } } }, { "category": "product_version_range", "name": "vers:unknown/10.17.9", "product": { "name": "vers:unknown/10.17.9", "product_id": "CSAFPID-5764963", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.17.9" } } }, { "category": "product_version_range", "name": "vers:unknown/10.18.0", "product": { "name": "vers:unknown/10.18.0", "product_id": "CSAFPID-5764964", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.18.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.18.1", "product": { "name": "vers:unknown/10.18.1", "product_id": "CSAFPID-5764965", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.18.1" } } }, { "category": "product_version_range", "name": "vers:unknown/10.18.2", "product": { "name": "vers:unknown/10.18.2", "product_id": "CSAFPID-5764966", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.18.2" } } }, { "category": "product_version_range", "name": "vers:unknown/10.18.3", "product": { "name": "vers:unknown/10.18.3", "product_id": "CSAFPID-5764967", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.18.3" } } }, { "category": "product_version_range", "name": "vers:unknown/10.19.0", "product": { "name": "vers:unknown/10.19.0", "product_id": "CSAFPID-5764968", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.19.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.2.0", "product": { "name": "vers:unknown/10.2.0", "product_id": "CSAFPID-5764969", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.2.1", "product": { "name": "vers:unknown/10.2.1", "product_id": "CSAFPID-5764970", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.2.1" } } }, { "category": "product_version_range", "name": "vers:unknown/10.20.0", "product": { "name": "vers:unknown/10.20.0", "product_id": "CSAFPID-5764971", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.20.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.20.1", "product": { "name": "vers:unknown/10.20.1", "product_id": "CSAFPID-5764972", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.20.1" } } }, { "category": "product_version_range", "name": "vers:unknown/10.20.2", "product": { "name": "vers:unknown/10.20.2", "product_id": "CSAFPID-5764973", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.20.2" } } }, { "category": "product_version_range", "name": "vers:unknown/10.20.4", "product": { "name": "vers:unknown/10.20.4", "product_id": "CSAFPID-5764974", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.20.4" } } }, { "category": "product_version_range", "name": "vers:unknown/10.20.5", "product": { "name": "vers:unknown/10.20.5", "product_id": "CSAFPID-5764975", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.20.5" } } }, { "category": "product_version_range", "name": "vers:unknown/10.20.6", "product": { "name": "vers:unknown/10.20.6", "product_id": "CSAFPID-5764976", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.20.6" } } }, { "category": "product_version_range", "name": "vers:unknown/10.21.0", "product": { "name": "vers:unknown/10.21.0", "product_id": "CSAFPID-5846584", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.21.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.21.1", "product": { "name": "vers:unknown/10.21.1", "product_id": "CSAFPID-5846585", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.21.1" } } }, { "category": "product_version_range", "name": "vers:unknown/10.22.0", "product": { "name": "vers:unknown/10.22.0", "product_id": "CSAFPID-5846586", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.22.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.23.0", "product": { "name": "vers:unknown/10.23.0", "product_id": "CSAFPID-5846587", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.23.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.24.0", "product": { "name": "vers:unknown/10.24.0", "product_id": "CSAFPID-5846588", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.24.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.25.0", "product": { "name": "vers:unknown/10.25.0", "product_id": "CSAFPID-5846589", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.25.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.3.0", "product": { "name": "vers:unknown/10.3.0", "product_id": "CSAFPID-5764977", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.4.0", "product": { "name": "vers:unknown/10.4.0", "product_id": "CSAFPID-5764978", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.4.1", "product": { "name": "vers:unknown/10.4.1", "product_id": "CSAFPID-5764979", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.4.1" } } }, { "category": "product_version_range", "name": "vers:unknown/10.4.2", "product": { "name": "vers:unknown/10.4.2", "product_id": "CSAFPID-5764980", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.4.2" } } }, { "category": "product_version_range", "name": "vers:unknown/10.4.3", "product": { "name": "vers:unknown/10.4.3", "product_id": "CSAFPID-5764981", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.4.3" } } }, { "category": "product_version_range", "name": "vers:unknown/10.4.4", "product": { "name": "vers:unknown/10.4.4", "product_id": "CSAFPID-5764982", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.4.4" } } }, { "category": "product_version_range", "name": "vers:unknown/10.4.5", "product": { "name": "vers:unknown/10.4.5", "product_id": "CSAFPID-5764983", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.4.5" } } }, { "category": "product_version_range", "name": "vers:unknown/10.4.6", "product": { "name": "vers:unknown/10.4.6", "product_id": "CSAFPID-5764984", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.4.6" } } }, { "category": "product_version_range", "name": "vers:unknown/10.5.0", "product": { "name": "vers:unknown/10.5.0", "product_id": "CSAFPID-5764985", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.5.1", "product": { "name": "vers:unknown/10.5.1", "product_id": "CSAFPID-5764986", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.5.1" } } }, { "category": "product_version_range", "name": "vers:unknown/10.6.0", "product": { "name": "vers:unknown/10.6.0", "product_id": "CSAFPID-5764987", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.6.1", "product": { "name": "vers:unknown/10.6.1", "product_id": "CSAFPID-5764988", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.6.1" } } }, { "category": "product_version_range", "name": "vers:unknown/10.7.0", "product": { "name": "vers:unknown/10.7.0", "product_id": "CSAFPID-5764989", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.7.1", "product": { "name": "vers:unknown/10.7.1", "product_id": "CSAFPID-5764990", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.7.1" } } }, { "category": "product_version_range", "name": "vers:unknown/10.7.2", "product": { "name": "vers:unknown/10.7.2", "product_id": "CSAFPID-5764991", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.7.2" } } }, { "category": "product_version_range", "name": "vers:unknown/10.8.0", "product": { "name": "vers:unknown/10.8.0", "product_id": "CSAFPID-5764992", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.8.0" } } }, { "category": "product_version_range", "name": "vers:unknown/10.9.0", "product": { "name": "vers:unknown/10.9.0", "product_id": "CSAFPID-5764993", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@10.9.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.24.0", "product": { "name": "vers:unknown/8.24.0", "product_id": "CSAFPID-5764994", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.24.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.25.1", "product": { "name": "vers:unknown/8.25.1", "product_id": "CSAFPID-5764995", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.25.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.25.2", "product": { "name": "vers:unknown/8.25.2", "product_id": "CSAFPID-5764996", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.25.2" } } }, { "category": "product_version_range", "name": "vers:unknown/8.26.0", "product": { "name": "vers:unknown/8.26.0", "product_id": "CSAFPID-5764997", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.26.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.27.0", "product": { "name": "vers:unknown/8.27.0", "product_id": "CSAFPID-5764998", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.27.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.27.1", "product": { "name": "vers:unknown/8.27.1", "product_id": "CSAFPID-5764999", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.27.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.27.2", "product": { "name": "vers:unknown/8.27.2", "product_id": "CSAFPID-5765000", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.27.2" } } }, { "category": "product_version_range", "name": "vers:unknown/8.28.0", "product": { "name": "vers:unknown/8.28.0", "product_id": "CSAFPID-5765001", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.28.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.28.1", "product": { "name": "vers:unknown/8.28.1", "product_id": "CSAFPID-5765002", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.28.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.29.0", "product": { "name": "vers:unknown/8.29.0", "product_id": "CSAFPID-5765003", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.29.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.30.0", "product": { "name": "vers:unknown/8.30.0", "product_id": "CSAFPID-5765004", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.30.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.31.0", "product": { "name": "vers:unknown/8.31.0", "product_id": "CSAFPID-5765005", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.31.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.32.0", "product": { "name": "vers:unknown/8.32.0", "product_id": "CSAFPID-5765006", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.32.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.33.0", "product": { "name": "vers:unknown/8.33.0", "product_id": "CSAFPID-5765007", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.33.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.34.0", "product": { "name": "vers:unknown/8.34.0", "product_id": "CSAFPID-5765008", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.34.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.35.0", "product": { "name": "vers:unknown/8.35.0", "product_id": "CSAFPID-5765009", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.35.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.36.0", "product": { "name": "vers:unknown/8.36.0", "product_id": "CSAFPID-5765010", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.36.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.36.1", "product": { "name": "vers:unknown/8.36.1", "product_id": "CSAFPID-5765011", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.36.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.37.0", "product": { "name": "vers:unknown/8.37.0", "product_id": "CSAFPID-5765012", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.37.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.38.0", "product": { "name": "vers:unknown/8.38.0", "product_id": "CSAFPID-5765013", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.38.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.38.1", "product": { "name": "vers:unknown/8.38.1", "product_id": "CSAFPID-5765014", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.38.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.39.0", "product": { "name": "vers:unknown/8.39.0", "product_id": "CSAFPID-5765015", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.39.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.39.1", "product": { "name": "vers:unknown/8.39.1", "product_id": "CSAFPID-5765016", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.39.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.40.0", "product": { "name": "vers:unknown/8.40.0", "product_id": "CSAFPID-5765017", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.40.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.41.0", "product": { "name": "vers:unknown/8.41.0", "product_id": "CSAFPID-5765018", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.41.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.41.1", "product": { "name": "vers:unknown/8.41.1", "product_id": "CSAFPID-5765019", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.41.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.41.2", "product": { "name": "vers:unknown/8.41.2", "product_id": "CSAFPID-5765020", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.41.2" } } }, { "category": "product_version_range", "name": "vers:unknown/8.42.0", "product": { "name": "vers:unknown/8.42.0", "product_id": "CSAFPID-5765021", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.42.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.42.1", "product": { "name": "vers:unknown/8.42.1", "product_id": "CSAFPID-5765022", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.42.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.43.0", "product": { "name": "vers:unknown/8.43.0", "product_id": "CSAFPID-5765023", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.43.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.44.0", "product": { "name": "vers:unknown/8.44.0", "product_id": "CSAFPID-5765024", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.44.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.45.0", "product": { "name": "vers:unknown/8.45.0", "product_id": "CSAFPID-5765025", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.45.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.45.1", "product": { "name": "vers:unknown/8.45.1", "product_id": "CSAFPID-5765026", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.45.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.45.2", "product": { "name": "vers:unknown/8.45.2", "product_id": "CSAFPID-5765027", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.45.2" } } }, { "category": "product_version_range", "name": "vers:unknown/8.45.3", "product": { "name": "vers:unknown/8.45.3", "product_id": "CSAFPID-5765028", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.45.3" } } }, { "category": "product_version_range", "name": "vers:unknown/8.46.0", "product": { "name": "vers:unknown/8.46.0", "product_id": "CSAFPID-5765029", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.46.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.46.1", "product": { "name": "vers:unknown/8.46.1", "product_id": "CSAFPID-5765030", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.46.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.46.2", "product": { "name": "vers:unknown/8.46.2", "product_id": "CSAFPID-5765031", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.46.2" } } }, { "category": "product_version_range", "name": "vers:unknown/8.46.3", "product": { "name": "vers:unknown/8.46.3", "product_id": "CSAFPID-5765032", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.46.3" } } }, { "category": "product_version_range", "name": "vers:unknown/8.47.0", "product": { "name": "vers:unknown/8.47.0", "product_id": "CSAFPID-5765033", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.47.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.47.1", "product": { "name": "vers:unknown/8.47.1", "product_id": "CSAFPID-5765034", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.47.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.48.0", "product": { "name": "vers:unknown/8.48.0", "product_id": "CSAFPID-5765035", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.48.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.48.1", "product": { "name": "vers:unknown/8.48.1", "product_id": "CSAFPID-5765036", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.48.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.48.2", "product": { "name": "vers:unknown/8.48.2", "product_id": "CSAFPID-5765037", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.48.2" } } }, { "category": "product_version_range", "name": "vers:unknown/8.48.3", "product": { "name": "vers:unknown/8.48.3", "product_id": "CSAFPID-5765038", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.48.3" } } }, { "category": "product_version_range", "name": "vers:unknown/8.48.4", "product": { "name": "vers:unknown/8.48.4", "product_id": "CSAFPID-5765039", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.48.4" } } }, { "category": "product_version_range", "name": "vers:unknown/8.49.0", "product": { "name": "vers:unknown/8.49.0", "product_id": "CSAFPID-5765040", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.49.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.50.0", "product": { "name": "vers:unknown/8.50.0", "product_id": "CSAFPID-5765041", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.50.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.50.1", "product": { "name": "vers:unknown/8.50.1", "product_id": "CSAFPID-5765042", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.50.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.51.0", "product": { "name": "vers:unknown/8.51.0", "product_id": "CSAFPID-5765043", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.51.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.52.0", "product": { "name": "vers:unknown/8.52.0", "product_id": "CSAFPID-5765044", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.52.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.52.1", "product": { "name": "vers:unknown/8.52.1", "product_id": "CSAFPID-5765045", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.52.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.52.2", "product": { "name": "vers:unknown/8.52.2", "product_id": "CSAFPID-5765046", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.52.2" } } }, { "category": "product_version_range", "name": "vers:unknown/8.53.0", "product": { "name": "vers:unknown/8.53.0", "product_id": "CSAFPID-5765047", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.53.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.54.0", "product": { "name": "vers:unknown/8.54.0", "product_id": "CSAFPID-5765048", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.54.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.54.1", "product": { "name": "vers:unknown/8.54.1", "product_id": "CSAFPID-5765049", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.54.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.54.2", "product": { "name": "vers:unknown/8.54.2", "product_id": "CSAFPID-5765050", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.54.2" } } }, { "category": "product_version_range", "name": "vers:unknown/8.54.3", "product": { "name": "vers:unknown/8.54.3", "product_id": "CSAFPID-5765051", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.54.3" } } }, { "category": "product_version_range", "name": "vers:unknown/8.54.4", "product": { "name": "vers:unknown/8.54.4", "product_id": "CSAFPID-5765052", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.54.4" } } }, { "category": "product_version_range", "name": "vers:unknown/8.55.0", "product": { "name": "vers:unknown/8.55.0", "product_id": "CSAFPID-5765053", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.55.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.57.1", "product": { "name": "vers:unknown/8.57.1", "product_id": "CSAFPID-5765054", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.57.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.58.0", "product": { "name": "vers:unknown/8.58.0", "product_id": "CSAFPID-5765055", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.58.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.59.0", "product": { "name": "vers:unknown/8.59.0", "product_id": "CSAFPID-5765056", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.59.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.60.0", "product": { "name": "vers:unknown/8.60.0", "product_id": "CSAFPID-5765057", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.60.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.61.0", "product": { "name": "vers:unknown/8.61.0", "product_id": "CSAFPID-5765058", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.61.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.61.1", "product": { "name": "vers:unknown/8.61.1", "product_id": "CSAFPID-5765059", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.61.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.61.2", "product": { "name": "vers:unknown/8.61.2", "product_id": "CSAFPID-5765060", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.61.2" } } }, { "category": "product_version_range", "name": "vers:unknown/8.62.0", "product": { "name": "vers:unknown/8.62.0", "product_id": "CSAFPID-5765061", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.62.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.62.1", "product": { "name": "vers:unknown/8.62.1", "product_id": "CSAFPID-5765062", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.62.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.62.10", "product": { "name": "vers:unknown/8.62.10", "product_id": "CSAFPID-5765063", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.62.10" } } }, { "category": "product_version_range", "name": "vers:unknown/8.62.11", "product": { "name": "vers:unknown/8.62.11", "product_id": "CSAFPID-5765064", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.62.11" } } }, { "category": "product_version_range", "name": "vers:unknown/8.62.12", "product": { "name": "vers:unknown/8.62.12", "product_id": "CSAFPID-5765065", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.62.12" } } }, { "category": "product_version_range", "name": "vers:unknown/8.62.13", "product": { "name": "vers:unknown/8.62.13", "product_id": "CSAFPID-5765066", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.62.13" } } }, { "category": "product_version_range", "name": "vers:unknown/8.62.2", "product": { "name": "vers:unknown/8.62.2", "product_id": "CSAFPID-5765067", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.62.2" } } }, { "category": "product_version_range", "name": "vers:unknown/8.62.3", "product": { "name": "vers:unknown/8.62.3", "product_id": "CSAFPID-5765068", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.62.3" } } }, { "category": "product_version_range", "name": "vers:unknown/8.62.4", "product": { "name": "vers:unknown/8.62.4", "product_id": "CSAFPID-5765069", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.62.4" } } }, { "category": "product_version_range", "name": "vers:unknown/8.62.5", "product": { "name": "vers:unknown/8.62.5", "product_id": "CSAFPID-5765070", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.62.5" } } }, { "category": "product_version_range", "name": "vers:unknown/8.62.6", "product": { "name": "vers:unknown/8.62.6", "product_id": "CSAFPID-5765071", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.62.6" } } }, { "category": "product_version_range", "name": "vers:unknown/8.62.7", "product": { "name": "vers:unknown/8.62.7", "product_id": "CSAFPID-5765072", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.62.7" } } }, { "category": "product_version_range", "name": "vers:unknown/8.62.8", "product": { "name": "vers:unknown/8.62.8", "product_id": "CSAFPID-5765073", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.62.8" } } }, { "category": "product_version_range", "name": "vers:unknown/8.62.9", "product": { "name": "vers:unknown/8.62.9", "product_id": "CSAFPID-5765074", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.62.9" } } }, { "category": "product_version_range", "name": "vers:unknown/8.63.0", "product": { "name": "vers:unknown/8.63.0", "product_id": "CSAFPID-5765075", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.63.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.63.1", "product": { "name": "vers:unknown/8.63.1", "product_id": "CSAFPID-5765076", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.63.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.64.0", "product": { "name": "vers:unknown/8.64.0", "product_id": "CSAFPID-5765077", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.64.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.65.0", "product": { "name": "vers:unknown/8.65.0", "product_id": "CSAFPID-5765078", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.65.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.66.0", "product": { "name": "vers:unknown/8.66.0", "product_id": "CSAFPID-5765079", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.66.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.67.0", "product": { "name": "vers:unknown/8.67.0", "product_id": "CSAFPID-5765080", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.67.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.68.0", "product": { "name": "vers:unknown/8.68.0", "product_id": "CSAFPID-5765081", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.68.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.68.1", "product": { "name": "vers:unknown/8.68.1", "product_id": "CSAFPID-5765082", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.68.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.68.2", "product": { "name": "vers:unknown/8.68.2", "product_id": "CSAFPID-5765083", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.68.2" } } }, { "category": "product_version_range", "name": "vers:unknown/8.69.0", "product": { "name": "vers:unknown/8.69.0", "product_id": "CSAFPID-5765084", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.69.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.70.0", "product": { "name": "vers:unknown/8.70.0", "product_id": "CSAFPID-5765085", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.70.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.71.0", "product": { "name": "vers:unknown/8.71.0", "product_id": "CSAFPID-5765086", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.71.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.72.0", "product": { "name": "vers:unknown/8.72.0", "product_id": "CSAFPID-5765087", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.72.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.73.0", "product": { "name": "vers:unknown/8.73.0", "product_id": "CSAFPID-5765088", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.73.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.74.0", "product": { "name": "vers:unknown/8.74.0", "product_id": "CSAFPID-5765089", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.74.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.75.0", "product": { "name": "vers:unknown/8.75.0", "product_id": "CSAFPID-5765090", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.75.0" } } }, { "category": "product_version_range", "name": "vers:unknown/8.75.1", "product": { "name": "vers:unknown/8.75.1", "product_id": "CSAFPID-5765091", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.75.1" } } }, { "category": "product_version_range", "name": "vers:unknown/8.76.0", "product": { "name": "vers:unknown/8.76.0", "product_id": "CSAFPID-5765092", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@8.76.0" } } }, { "category": "product_version_range", "name": "vers:unknown/9.0.0", "product": { "name": "vers:unknown/9.0.0", "product_id": "CSAFPID-5765093", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@9.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/9.0.1", "product": { "name": "vers:unknown/9.0.1", "product_id": "CSAFPID-5765094", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@9.0.1" } } }, { "category": "product_version_range", "name": "vers:unknown/9.0.2", "product": { "name": "vers:unknown/9.0.2", "product_id": "CSAFPID-5765095", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@9.0.2" } } }, { "category": "product_version_range", "name": "vers:unknown/9.0.3", "product": { "name": "vers:unknown/9.0.3", "product_id": "CSAFPID-5765096", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@9.0.3" } } }, { "category": "product_version_range", "name": "vers:unknown/9.0.4", "product": { "name": "vers:unknown/9.0.4", "product_id": "CSAFPID-5765097", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@9.0.4" } } }, { "category": "product_version_range", "name": "vers:unknown/9.0.5", "product": { "name": "vers:unknown/9.0.5", "product_id": "CSAFPID-5765098", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@9.0.5" } } }, { "category": "product_version_range", "name": "vers:unknown/9.0.6", "product": { "name": "vers:unknown/9.0.6", "product_id": "CSAFPID-5765099", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@9.0.6" } } }, { "category": "product_version_range", "name": "vers:unknown/9.2.0", "product": { "name": "vers:unknown/9.2.0", "product_id": "CSAFPID-5765100", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@9.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/9.2.1", "product": { "name": "vers:unknown/9.2.1", "product_id": "CSAFPID-5765101", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@9.2.1" } } }, { "category": "product_version_range", "name": "vers:unknown/9.3.1", "product": { "name": "vers:unknown/9.3.1", "product_id": "CSAFPID-5765102", "product_identification_helper": { "purl": "pkg:pypi/mcp-memory-service@9.3.1" } } }, { "category": "product_version_range", "name": "vers:unknown/<10.25.1", "product": { "name": "vers:unknown/<10.25.1", "product_id": "CSAFPID-5875707" } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<10.25.1", "product": { "name": "vers:unknown/>=0|<10.25.1", "product_id": "CSAFPID-5846590" } } ], "category": "product_name", "name": "mcp-memory-service" } ], "category": "vendor", "name": "doobidoo" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-33010", "cwe": { "id": "CWE-942", "name": "Permissive Cross-domain Security Policy with Untrusted Domains" }, "notes": [ { "category": "description", "text": "### Summary\nWhen the HTTP server is enabled (`MCP_HTTP_ENABLED=true`), the application configures FastAPI's CORSMiddleware with `allow_origins=['*']`, `allow_credentials=True`, `allow_methods=[\"*\"]`, and `allow_headers=[\"*\"]`. The wildcard `Access-Control-Allow-Origin: *` header permits any website to read API responses cross-origin. When combined with anonymous access (`MCP_ALLOW_ANONYMOUS_ACCESS=true`) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are needed, so any malicious website can silently read, modify, and delete all stored memories.\n\n\n### Details\n### Vulnerable Code\n\n**`config.py:546` - Wildcard CORS origin default**\n\n```python\nCORS_ORIGINS = os.getenv('MCP_CORS_ORIGINS', '*').split(',')\n```\n\nThis produces `['*']` by default, allowing any origin.\n\n**`app.py:274-280` - CORSMiddleware configuration**\n\n```python\n# CORS middleware\napp.add_middleware(\n CORSMiddleware,\n allow_origins=CORS_ORIGINS, # ['*'] by default\n allow_credentials=True, # Unnecessary for anonymous access; bad practice\n allow_methods=[\"*\"],\n allow_headers=[\"*\"],\n)\n```\n\n### How the Attack Works\n\nThe wildcard CORS default means every API response includes `Access-Control-Allow-Origin: *`. This tells browsers to allow **any website** to read the response. When combined with anonymous access (no authentication required), the attack is straightforward:\n\n```javascript\n// Running on https://evil.com - reads victim's memories\n// No credentials needed - anonymous access means the API is open\nconst response = await fetch('http://192.168.1.100:8000/api/memories');\nconst memories = await response.json();\n// memories contains every stored memory - passwords, API keys, personal notes\n```\n\nThe browser sends the request, the server responds with `ACAO: *`, and the browser allows the JavaScript to read the response body. No cookies, no auth headers, no credentials of any kind.\n\n**Clarification on `allow_credentials=True`:** The advisory originally stated that Starlette reflects the `Origin` header when `allow_credentials=True` with wildcard origins. Testing with Starlette 0.52.1 shows that **actual responses return `ACAO: *`** (not the reflected origin); only preflight `OPTIONS` responses reflect the origin. Per the Fetch specification, browsers block `ACAO: *` when `credentials: 'include'` is used. However, this is irrelevant to the attack because **anonymous access means no credentials are needed** - a plain `fetch()` without `credentials: 'include'` works, and `ACAO: *` allows it.\n\n### Two Attack Vectors\n\nThis misconfiguration enables two distinct attack paths:\n\n**1. Cross-origin browser attack (CORS - this advisory)**\n- Attacker lures victim to a malicious webpage\n- JavaScript on the page reads/writes the memory service API\n- Works from anywhere on the internet if the victim visits the page\n- The `ACAO: *` header is what allows the browser to expose the response to the attacker's JavaScript\n\n**2. Direct network access (compounding factor)**\n- Attacker on the same network directly calls the API (`curl http://:8000/api/memories`)\n- No CORS involved - CORS is a browser-only restriction\n- Enabled by `0.0.0.0` binding + anonymous access, independent of CORS configuration\n\nThe CORS misconfiguration specifically enables attack vector #1, extending the reach from local network to anyone who can get the victim to click a link.\n\n### Compounding Factors\n\n- **`HTTP_HOST = '0.0.0.0'`** - Binds to all interfaces, exposing the service to the entire network (enables attack vector #2)\n- **`HTTPS_ENABLED = 'false'`** - No TLS by default, allowing passive interception\n- **`MCP_ALLOW_ANONYMOUS_ACCESS`** - When enabled, no authentication is required at all. This is the key enabler: without it, the CORS wildcard alone would not allow data access (the attacker would need to forward valid credentials, which `ACAO: *` blocks)\n- **`allow_credentials=True`** - Bad practice: if a future Starlette version changes to reflect origins (as some CORS implementations do), this would escalate the vulnerability by allowing credential-forwarding attacks against OAuth/API-key users\n- **API key via query parameter** - `api_key` query param is cached in browser history and server logs\n\n### Attack Scenario\n\n1. Victim runs `mcp-memory-service` with HTTP enabled and anonymous access\n2. Victim visits `https://evil.com` which includes JavaScript\n3. JavaScript sends `fetch('http://:8000/api/memories')` (no credentials needed)\n4. Server responds with `Access-Control-Allow-Origin: *`\n5. Browser allows JavaScript to read the response - attacker receives all memories\n6. Attacker's script also calls DELETE/PUT endpoints to modify or destroy memories\n7. Victim sees a normal web page; no indication of the attack\n\n### Root Cause\n\nThe default value of `MCP_CORS_ORIGINS` is `*`, which allows any website to read API responses. This is a permissive default that should be restricted to the expected dashboard origin (typically `localhost`). The `allow_credentials=True` is an additional misconfiguration that doesn't currently enable the attack.\n\n\n### PoC\n```python\nfrom fastapi import FastAPI\nfrom fastapi.middleware.cors import CORSMiddleware\nfrom starlette.testclient import TestClient\n\napp = FastAPI()\napp.add_middleware(\n CORSMiddleware,\n allow_origins=[\"*\"],\n allow_credentials=True,\n allow_methods=[\"*\"],\n allow_headers=[\"*\"],\n)\n\n@app.get(\"/api/memories\")\ndef memories():\n return [{\"content\": \"secret memory data\"}]\n\nclient = TestClient(app)\n\n# Non-credentialed request (how the real attack works with anonymous access)\nresponse = client.get(\"/api/memories\", headers={\"Origin\": \"https://evil.com\"})\nprint(response.headers[\"access-control-allow-origin\"]) # *\nprint(response.json()) # [{\"content\": \"secret memory data\"}]\n# Any website can read this response because ACAO is *\n```\n\n\n### Impact\n- **Complete cross-origin memory access**: Any website can read all stored memories when the victim has the HTTP server running with anonymous access\n- **Memory tampering**: Write/delete endpoints are also accessible cross-origin, allowing memory destruction\n- **Remote attack surface**: Unlike direct network access (which requires LAN proximity), the CORS vector works from anywhere on the internet - the victim just needs to visit a link\n- **Silent exfiltration**: The attack is invisible to the victim; no browser warnings, no popups, no indicators\n\n## Remediation\n\nReplace the wildcard default with an explicit localhost origin:\n\n```python\n# In config.py (safe default)\nCORS_ORIGINS = os.getenv('MCP_CORS_ORIGINS', 'http://localhost:8000,http://127.0.0.1:8000').split(',')\n\n# In app.py - warn on wildcard\nif '*' in CORS_ORIGINS:\n logger.warning(\"Wildcard CORS origin detected. This allows any website to access the API. \"\n \"Set MCP_CORS_ORIGINS to restrict access.\")\n\n# Also: set allow_credentials=False unless specific origins are configured\napp.add_middleware(\n CORSMiddleware,\n allow_origins=CORS_ORIGINS,\n allow_credentials='*' not in CORS_ORIGINS, # Only with explicit origins\n allow_methods=[\"*\"],\n allow_headers=[\"*\"],\n)\n```\n\n## Affected Deployments\nThe vulnerability exists in the Python source code and is not mitigated by any deployment-specific configuration. Docker HTTP mode is the highest-risk deployment because it explicitly binds to `0.0.0.0`, maps the port, and does not override the wildcard CORS default.", "title": "github - https://github.com/advisories/GHSA-g9rg-8vq5-mpwm" }, { "category": "description", "text": "### Summary\nWhen the HTTP server is enabled (`MCP_HTTP_ENABLED=true`), the application configures FastAPI's CORSMiddleware with `allow_origins=['*']`, `allow_credentials=True`, `allow_methods=[\"*\"]`, and `allow_headers=[\"*\"]`. The wildcard `Access-Control-Allow-Origin: *` header permits any website to read API responses cross-origin. When combined with anonymous access (`MCP_ALLOW_ANONYMOUS_ACCESS=true`) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are needed, so any malicious website can silently read, modify, and delete all stored memories.\n\n\n### Details\n### Vulnerable Code\n\n**`config.py:546` - Wildcard CORS origin default**\n\n```python\nCORS_ORIGINS = os.getenv('MCP_CORS_ORIGINS', '*').split(',')\n```\n\nThis produces `['*']` by default, allowing any origin.\n\n**`app.py:274-280` - CORSMiddleware configuration**\n\n```python\n# CORS middleware\napp.add_middleware(\n CORSMiddleware,\n allow_origins=CORS_ORIGINS, # ['*'] by default\n allow_credentials=True, # Unnecessary for anonymous access; bad practice\n allow_methods=[\"*\"],\n allow_headers=[\"*\"],\n)\n```\n\n### How the Attack Works\n\nThe wildcard CORS default means every API response includes `Access-Control-Allow-Origin: *`. This tells browsers to allow **any website** to read the response. When combined with anonymous access (no authentication required), the attack is straightforward:\n\n```javascript\n// Running on https://evil.com - reads victim's memories\n// No credentials needed - anonymous access means the API is open\nconst response = await fetch('http://192.168.1.100:8000/api/memories');\nconst memories = await response.json();\n// memories contains every stored memory - passwords, API keys, personal notes\n```\n\nThe browser sends the request, the server responds with `ACAO: *`, and the browser allows the JavaScript to read the response body. No cookies, no auth headers, no credentials of any kind.\n\n**Clarification on `allow_credentials=True`:** The advisory originally stated that Starlette reflects the `Origin` header when `allow_credentials=True` with wildcard origins. Testing with Starlette 0.52.1 shows that **actual responses return `ACAO: *`** (not the reflected origin); only preflight `OPTIONS` responses reflect the origin. Per the Fetch specification, browsers block `ACAO: *` when `credentials: 'include'` is used. However, this is irrelevant to the attack because **anonymous access means no credentials are needed** - a plain `fetch()` without `credentials: 'include'` works, and `ACAO: *` allows it.\n\n### Two Attack Vectors\n\nThis misconfiguration enables two distinct attack paths:\n\n**1. Cross-origin browser attack (CORS - this advisory)**\n- Attacker lures victim to a malicious webpage\n- JavaScript on the page reads/writes the memory service API\n- Works from anywhere on the internet if the victim visits the page\n- The `ACAO: *` header is what allows the browser to expose the response to the attacker's JavaScript\n\n**2. Direct network access (compounding factor)**\n- Attacker on the same network directly calls the API (`curl http://:8000/api/memories`)\n- No CORS involved - CORS is a browser-only restriction\n- Enabled by `0.0.0.0` binding + anonymous access, independent of CORS configuration\n\nThe CORS misconfiguration specifically enables attack vector #1, extending the reach from local network to anyone who can get the victim to click a link.\n\n### Compounding Factors\n\n- **`HTTP_HOST = '0.0.0.0'`** - Binds to all interfaces, exposing the service to the entire network (enables attack vector #2)\n- **`HTTPS_ENABLED = 'false'`** - No TLS by default, allowing passive interception\n- **`MCP_ALLOW_ANONYMOUS_ACCESS`** - When enabled, no authentication is required at all. This is the key enabler: without it, the CORS wildcard alone would not allow data access (the attacker would need to forward valid credentials, which `ACAO: *` blocks)\n- **`allow_credentials=True`** - Bad practice: if a future Starlette version changes to reflect origins (as some CORS implementations do), this would escalate the vulnerability by allowing credential-forwarding attacks against OAuth/API-key users\n- **API key via query parameter** - `api_key` query param is cached in browser history and server logs\n\n### Attack Scenario\n\n1. Victim runs `mcp-memory-service` with HTTP enabled and anonymous access\n2. Victim visits `https://evil.com` which includes JavaScript\n3. JavaScript sends `fetch('http://:8000/api/memories')` (no credentials needed)\n4. Server responds with `Access-Control-Allow-Origin: *`\n5. Browser allows JavaScript to read the response - attacker receives all memories\n6. Attacker's script also calls DELETE/PUT endpoints to modify or destroy memories\n7. Victim sees a normal web page; no indication of the attack\n\n### Root Cause\n\nThe default value of `MCP_CORS_ORIGINS` is `*`, which allows any website to read API responses. This is a permissive default that should be restricted to the expected dashboard origin (typically `localhost`). The `allow_credentials=True` is an additional misconfiguration that doesn't currently enable the attack.\n\n\n### PoC\n```python\nfrom fastapi import FastAPI\nfrom fastapi.middleware.cors import CORSMiddleware\nfrom starlette.testclient import TestClient\n\napp = FastAPI()\napp.add_middleware(\n CORSMiddleware,\n allow_origins=[\"*\"],\n allow_credentials=True,\n allow_methods=[\"*\"],\n allow_headers=[\"*\"],\n)\n\n@app.get(\"/api/memories\")\ndef memories():\n return [{\"content\": \"secret memory data\"}]\n\nclient = TestClient(app)\n\n# Non-credentialed request (how the real attack works with anonymous access)\nresponse = client.get(\"/api/memories\", headers={\"Origin\": \"https://evil.com\"})\nprint(response.headers[\"access-control-allow-origin\"]) # *\nprint(response.json()) # [{\"content\": \"secret memory data\"}]\n# Any website can read this response because ACAO is *\n```\n\n\n### Impact\n- **Complete cross-origin memory access**: Any website can read all stored memories when the victim has the HTTP server running with anonymous access\n- **Memory tampering**: Write/delete endpoints are also accessible cross-origin, allowing memory destruction\n- **Remote attack surface**: Unlike direct network access (which requires LAN proximity), the CORS vector works from anywhere on the internet - the victim just needs to visit a link\n- **Silent exfiltration**: The attack is invisible to the victim; no browser warnings, no popups, no indicators\n\n## Remediation\n\nReplace the wildcard default with an explicit localhost origin:\n\n```python\n# In config.py (safe default)\nCORS_ORIGINS = os.getenv('MCP_CORS_ORIGINS', 'http://localhost:8000,http://127.0.0.1:8000').split(',')\n\n# In app.py - warn on wildcard\nif '*' in CORS_ORIGINS:\n logger.warning(\"Wildcard CORS origin detected. This allows any website to access the API. \"\n \"Set MCP_CORS_ORIGINS to restrict access.\")\n\n# Also: set allow_credentials=False unless specific origins are configured\napp.add_middleware(\n CORSMiddleware,\n allow_origins=CORS_ORIGINS,\n allow_credentials='*' not in CORS_ORIGINS, # Only with explicit origins\n allow_methods=[\"*\"],\n allow_headers=[\"*\"],\n)\n```\n\n## Affected Deployments\nThe vulnerability exists in the Python source code and is not mitigated by any deployment-specific configuration. Docker HTTP mode is the highest-risk deployment because it explicitly binds to `0.0.0.0`, maps the port, and does not override the wildcard CORS default.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/PyPI%2FGHSA-g9rg-8vq5-mpwm.json?alt=media" }, { "category": "description", "text": "### Summary\nWhen the HTTP server is enabled (`MCP_HTTP_ENABLED=true`), the application configures FastAPI's CORSMiddleware with `allow_origins=['*']`, `allow_credentials=True`, `allow_methods=[\"*\"]`, and `allow_headers=[\"*\"]`. The wildcard `Access-Control-Allow-Origin: *` header permits any website to read API responses cross-origin. When combined with anonymous access (`MCP_ALLOW_ANONYMOUS_ACCESS=true`) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are needed, so any malicious website can silently read, modify, and delete all stored memories.\n\n\n### Details\n### Vulnerable Code\n\n**`config.py:546` - Wildcard CORS origin default**\n\n```python\nCORS_ORIGINS = os.getenv('MCP_CORS_ORIGINS', '*').split(',')\n```\n\nThis produces `['*']` by default, allowing any origin.\n\n**`app.py:274-280` - CORSMiddleware configuration**\n\n```python\n# CORS middleware\napp.add_middleware(\n CORSMiddleware,\n allow_origins=CORS_ORIGINS, # ['*'] by default\n allow_credentials=True, # Unnecessary for anonymous access; bad practice\n allow_methods=[\"*\"],\n allow_headers=[\"*\"],\n)\n```\n\n### How the Attack Works\n\nThe wildcard CORS default means every API response includes `Access-Control-Allow-Origin: *`. This tells browsers to allow **any website** to read the response. When combined with anonymous access (no authentication required), the attack is straightforward:\n\n```javascript\n// Running on https://evil.com - reads victim's memories\n// No credentials needed - anonymous access means the API is open\nconst response = await fetch('http://192.168.1.100:8000/api/memories');\nconst memories = await response.json();\n// memories contains every stored memory - passwords, API keys, personal notes\n```\n\nThe browser sends the request, the server responds with `ACAO: *`, and the browser allows the JavaScript to read the response body. No cookies, no auth headers, no credentials of any kind.\n\n**Clarification on `allow_credentials=True`:** The advisory originally stated that Starlette reflects the `Origin` header when `allow_credentials=True` with wildcard origins. Testing with Starlette 0.52.1 shows that **actual responses return `ACAO: *`** (not the reflected origin); only preflight `OPTIONS` responses reflect the origin. Per the Fetch specification, browsers block `ACAO: *` when `credentials: 'include'` is used. However, this is irrelevant to the attack because **anonymous access means no credentials are needed** - a plain `fetch()` without `credentials: 'include'` works, and `ACAO: *` allows it.\n\n### Two Attack Vectors\n\nThis misconfiguration enables two distinct attack paths:\n\n**1. Cross-origin browser attack (CORS - this advisory)**\n- Attacker lures victim to a malicious webpage\n- JavaScript on the page reads/writes the memory service API\n- Works from anywhere on the internet if the victim visits the page\n- The `ACAO: *` header is what allows the browser to expose the response to the attacker's JavaScript\n\n**2. Direct network access (compounding factor)**\n- Attacker on the same network directly calls the API (`curl http://:8000/api/memories`)\n- No CORS involved - CORS is a browser-only restriction\n- Enabled by `0.0.0.0` binding + anonymous access, independent of CORS configuration\n\nThe CORS misconfiguration specifically enables attack vector #1, extending the reach from local network to anyone who can get the victim to click a link.\n\n### Compounding Factors\n\n- **`HTTP_HOST = '0.0.0.0'`** - Binds to all interfaces, exposing the service to the entire network (enables attack vector #2)\n- **`HTTPS_ENABLED = 'false'`** - No TLS by default, allowing passive interception\n- **`MCP_ALLOW_ANONYMOUS_ACCESS`** - When enabled, no authentication is required at all. This is the key enabler: without it, the CORS wildcard alone would not allow data access (the attacker would need to forward valid credentials, which `ACAO: *` blocks)\n- **`allow_credentials=True`** - Bad practice: if a future Starlette version changes to reflect origins (as some CORS implementations do), this would escalate the vulnerability by allowing credential-forwarding attacks against OAuth/API-key users\n- **API key via query parameter** - `api_key` query param is cached in browser history and server logs\n\n### Attack Scenario\n\n1. Victim runs `mcp-memory-service` with HTTP enabled and anonymous access\n2. Victim visits `https://evil.com` which includes JavaScript\n3. JavaScript sends `fetch('http://:8000/api/memories')` (no credentials needed)\n4. Server responds with `Access-Control-Allow-Origin: *`\n5. Browser allows JavaScript to read the response - attacker receives all memories\n6. Attacker's script also calls DELETE/PUT endpoints to modify or destroy memories\n7. Victim sees a normal web page; no indication of the attack\n\n### Root Cause\n\nThe default value of `MCP_CORS_ORIGINS` is `*`, which allows any website to read API responses. This is a permissive default that should be restricted to the expected dashboard origin (typically `localhost`). The `allow_credentials=True` is an additional misconfiguration that doesn't currently enable the attack.\n\n\n### PoC\n```python\nfrom fastapi import FastAPI\nfrom fastapi.middleware.cors import CORSMiddleware\nfrom starlette.testclient import TestClient\n\napp = FastAPI()\napp.add_middleware(\n CORSMiddleware,\n allow_origins=[\"*\"],\n allow_credentials=True,\n allow_methods=[\"*\"],\n allow_headers=[\"*\"],\n)\n\n@app.get(\"/api/memories\")\ndef memories():\n return [{\"content\": \"secret memory data\"}]\n\nclient = TestClient(app)\n\n# Non-credentialed request (how the real attack works with anonymous access)\nresponse = client.get(\"/api/memories\", headers={\"Origin\": \"https://evil.com\"})\nprint(response.headers[\"access-control-allow-origin\"]) # *\nprint(response.json()) # [{\"content\": \"secret memory data\"}]\n# Any website can read this response because ACAO is *\n```\n\n\n### Impact\n- **Complete cross-origin memory access**: Any website can read all stored memories when the victim has the HTTP server running with anonymous access\n- **Memory tampering**: Write/delete endpoints are also accessible cross-origin, allowing memory destruction\n- **Remote attack surface**: Unlike direct network access (which requires LAN proximity), the CORS vector works from anywhere on the internet - the victim just needs to visit a link\n- **Silent exfiltration**: The attack is invisible to the victim; no browser warnings, no popups, no indicators\n\n## Remediation\n\nReplace the wildcard default with an explicit localhost origin:\n\n```python\n# In config.py (safe default)\nCORS_ORIGINS = os.getenv('MCP_CORS_ORIGINS', 'http://localhost:8000,http://127.0.0.1:8000').split(',')\n\n# In app.py - warn on wildcard\nif '*' in CORS_ORIGINS:\n logger.warning(\"Wildcard CORS origin detected. This allows any website to access the API. \"\n \"Set MCP_CORS_ORIGINS to restrict access.\")\n\n# Also: set allow_credentials=False unless specific origins are configured\napp.add_middleware(\n CORSMiddleware,\n allow_origins=CORS_ORIGINS,\n allow_credentials='*' not in CORS_ORIGINS, # Only with explicit origins\n allow_methods=[\"*\"],\n allow_headers=[\"*\"],\n)\n```\n\n## Affected Deployments\nThe vulnerability exists in the Python source code and is not mitigated by any deployment-specific configuration. Docker HTTP mode is the highest-risk deployment because it explicitly binds to `0.0.0.0`, maps the port, and does not override the wildcard CORS default.", "title": "github - https://api.github.com/advisories/GHSA-g9rg-8vq5-mpwm" }, { "category": "description", "text": "mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application configures FastAPI's CORSMiddleware with allow_origins=['*'], allow_credentials=True, allow_methods=[\"*\"], and allow_headers=[\"*\"]. The wildcard Access-Control-Allow-Origin: * header permits any website to read API responses cross-origin. When combined with anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=true) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are needed, so any malicious website can silently read, modify, and delete all stored memories. This issue has been patched in version 10.25.1.", "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33010" }, { "category": "description", "text": "mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application configures FastAPI's CORSMiddleware with allow_origins=['*'], allow_credentials=True, allow_methods=[\"*\"], and allow_headers=[\"*\"]. The wildcard Access-Control-Allow-Origin: * header permits any website to read API responses cross-origin. When combined with anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=true) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are needed, so any malicious website can silently read, modify, and delete all stored memories. This issue has been patched in version 10.25.1.", "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33010.json" }, { "category": "other", "text": "0.0003", "title": "EPSS" }, { "category": "other", "text": "4.1", "title": "NCSC Score" }, { "category": "other", "text": "There is product data available from source Cveprojectv5", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "The value of the most recent EPSS score, There is cwe data available from source Nvd", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-5764922", "CSAFPID-5764923", "CSAFPID-5764924", "CSAFPID-5764925", "CSAFPID-5764926", "CSAFPID-5764927", "CSAFPID-5764928", "CSAFPID-5764929", "CSAFPID-5764930", "CSAFPID-5764931", "CSAFPID-5764932", "CSAFPID-5764933", "CSAFPID-5764934", "CSAFPID-5764935", "CSAFPID-5764936", "CSAFPID-5764937", "CSAFPID-5764938", "CSAFPID-5764939", "CSAFPID-5764940", "CSAFPID-5764941", "CSAFPID-5764942", "CSAFPID-5764943", "CSAFPID-5764944", "CSAFPID-5764945", "CSAFPID-5764946", "CSAFPID-5764947", "CSAFPID-5764948", "CSAFPID-5764949", "CSAFPID-5764950", "CSAFPID-5764951", "CSAFPID-5764952", "CSAFPID-5764953", "CSAFPID-5764954", "CSAFPID-5764955", "CSAFPID-5764956", "CSAFPID-5764957", "CSAFPID-5764958", "CSAFPID-5764959", "CSAFPID-5764960", "CSAFPID-5764961", "CSAFPID-5764962", "CSAFPID-5764963", "CSAFPID-5764964", "CSAFPID-5764965", "CSAFPID-5764966", "CSAFPID-5764967", "CSAFPID-5764968", "CSAFPID-5764969", "CSAFPID-5764970", "CSAFPID-5764971", "CSAFPID-5764972", "CSAFPID-5764973", "CSAFPID-5764974", "CSAFPID-5764975", "CSAFPID-5764976", "CSAFPID-5764977", "CSAFPID-5764978", "CSAFPID-5764979", "CSAFPID-5764980", "CSAFPID-5764981", "CSAFPID-5764982", "CSAFPID-5764983", "CSAFPID-5764984", "CSAFPID-5764985", "CSAFPID-5764986", "CSAFPID-5764987", "CSAFPID-5764988", "CSAFPID-5764989", "CSAFPID-5764990", "CSAFPID-5764991", "CSAFPID-5764992", "CSAFPID-5764993", "CSAFPID-5764994", "CSAFPID-5764995", "CSAFPID-5764996", "CSAFPID-5764997", "CSAFPID-5764998", "CSAFPID-5764999", "CSAFPID-5765000", "CSAFPID-5765001", "CSAFPID-5765002", "CSAFPID-5765003", "CSAFPID-5765004", "CSAFPID-5765005", "CSAFPID-5765006", "CSAFPID-5765007", "CSAFPID-5765008", "CSAFPID-5765009", "CSAFPID-5765010", "CSAFPID-5765011", "CSAFPID-5765012", "CSAFPID-5765013", "CSAFPID-5765014", "CSAFPID-5765015", "CSAFPID-5765016", "CSAFPID-5765017", "CSAFPID-5765018", "CSAFPID-5765019", "CSAFPID-5765020", "CSAFPID-5765021", "CSAFPID-5765022", "CSAFPID-5765023", "CSAFPID-5765024", "CSAFPID-5765025", "CSAFPID-5765026", "CSAFPID-5765027", "CSAFPID-5765028", "CSAFPID-5765029", "CSAFPID-5765030", "CSAFPID-5765031", "CSAFPID-5765032", "CSAFPID-5765033", "CSAFPID-5765034", "CSAFPID-5765035", "CSAFPID-5765036", "CSAFPID-5765037", "CSAFPID-5765038", "CSAFPID-5765039", "CSAFPID-5765040", "CSAFPID-5765041", "CSAFPID-5765042", "CSAFPID-5765043", "CSAFPID-5765044", "CSAFPID-5765045", "CSAFPID-5765046", "CSAFPID-5765047", "CSAFPID-5765048", "CSAFPID-5765049", "CSAFPID-5765050", "CSAFPID-5765051", "CSAFPID-5765052", "CSAFPID-5765053", "CSAFPID-5765054", "CSAFPID-5765055", "CSAFPID-5765056", "CSAFPID-5765057", "CSAFPID-5765058", "CSAFPID-5765059", "CSAFPID-5765060", "CSAFPID-5765061", "CSAFPID-5765062", "CSAFPID-5765063", "CSAFPID-5765064", "CSAFPID-5765065", "CSAFPID-5765066", "CSAFPID-5765067", "CSAFPID-5765068", "CSAFPID-5765069", "CSAFPID-5765070", "CSAFPID-5765071", "CSAFPID-5765072", "CSAFPID-5765073", "CSAFPID-5765074", "CSAFPID-5765075", "CSAFPID-5765076", "CSAFPID-5765077", "CSAFPID-5765078", "CSAFPID-5765079", "CSAFPID-5765080", "CSAFPID-5765081", "CSAFPID-5765082", "CSAFPID-5765083", "CSAFPID-5765084", "CSAFPID-5765085", "CSAFPID-5765086", "CSAFPID-5765087", "CSAFPID-5765088", "CSAFPID-5765089", "CSAFPID-5765090", "CSAFPID-5765091", "CSAFPID-5765092", "CSAFPID-5765093", "CSAFPID-5765094", "CSAFPID-5765095", "CSAFPID-5765096", "CSAFPID-5765097", "CSAFPID-5765098", "CSAFPID-5765099", "CSAFPID-5765100", "CSAFPID-5765101", "CSAFPID-5765102", "CSAFPID-5846584", "CSAFPID-5846585", "CSAFPID-5846586", "CSAFPID-5846587", "CSAFPID-5846588", "CSAFPID-5846589", "CSAFPID-5846590", "CSAFPID-5875707" ] }, "references": [ { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-g9rg-8vq5-mpwm" }, { "category": "external", "summary": "Source raw - github", "url": "https://api.github.com/advisories/GHSA-g9rg-8vq5-mpwm" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/PyPI%2FGHSA-g9rg-8vq5-mpwm.json?alt=media" }, { "category": "external", "summary": "Source - github", "url": "https://api.github.com/advisories/GHSA-g9rg-8vq5-mpwm" }, { "category": "external", "summary": "Source - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33010" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33010.json" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/doobidoo/mcp-memory-service/security/advisories/GHSA-g9rg-8vq5-mpwm" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-g9rg-8vq5-mpwm" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-5764922", "CSAFPID-5764923", "CSAFPID-5764924", "CSAFPID-5764925", "CSAFPID-5764926", "CSAFPID-5764927", "CSAFPID-5764928", "CSAFPID-5764929", "CSAFPID-5764930", "CSAFPID-5764931", "CSAFPID-5764932", "CSAFPID-5764933", "CSAFPID-5764934", "CSAFPID-5764935", "CSAFPID-5764936", "CSAFPID-5764937", "CSAFPID-5764938", "CSAFPID-5764939", "CSAFPID-5764940", "CSAFPID-5764941", "CSAFPID-5764942", "CSAFPID-5764943", "CSAFPID-5764944", "CSAFPID-5764945", "CSAFPID-5764946", "CSAFPID-5764947", "CSAFPID-5764948", "CSAFPID-5764949", "CSAFPID-5764950", "CSAFPID-5764951", "CSAFPID-5764952", "CSAFPID-5764953", "CSAFPID-5764954", "CSAFPID-5764955", "CSAFPID-5764956", "CSAFPID-5764957", "CSAFPID-5764958", "CSAFPID-5764959", "CSAFPID-5764960", "CSAFPID-5764961", "CSAFPID-5764962", "CSAFPID-5764963", "CSAFPID-5764964", "CSAFPID-5764965", "CSAFPID-5764966", "CSAFPID-5764967", "CSAFPID-5764968", "CSAFPID-5764969", "CSAFPID-5764970", "CSAFPID-5764971", "CSAFPID-5764972", "CSAFPID-5764973", "CSAFPID-5764974", "CSAFPID-5764975", "CSAFPID-5764976", "CSAFPID-5764977", "CSAFPID-5764978", "CSAFPID-5764979", "CSAFPID-5764980", "CSAFPID-5764981", "CSAFPID-5764982", "CSAFPID-5764983", "CSAFPID-5764984", "CSAFPID-5764985", "CSAFPID-5764986", "CSAFPID-5764987", "CSAFPID-5764988", "CSAFPID-5764989", "CSAFPID-5764990", "CSAFPID-5764991", "CSAFPID-5764992", "CSAFPID-5764993", "CSAFPID-5764994", "CSAFPID-5764995", "CSAFPID-5764996", "CSAFPID-5764997", "CSAFPID-5764998", "CSAFPID-5764999", "CSAFPID-5765000", "CSAFPID-5765001", "CSAFPID-5765002", "CSAFPID-5765003", "CSAFPID-5765004", "CSAFPID-5765005", "CSAFPID-5765006", "CSAFPID-5765007", "CSAFPID-5765008", "CSAFPID-5765009", "CSAFPID-5765010", "CSAFPID-5765011", "CSAFPID-5765012", "CSAFPID-5765013", "CSAFPID-5765014", "CSAFPID-5765015", "CSAFPID-5765016", "CSAFPID-5765017", "CSAFPID-5765018", "CSAFPID-5765019", "CSAFPID-5765020", "CSAFPID-5765021", "CSAFPID-5765022", "CSAFPID-5765023", "CSAFPID-5765024", "CSAFPID-5765025", "CSAFPID-5765026", "CSAFPID-5765027", "CSAFPID-5765028", "CSAFPID-5765029", "CSAFPID-5765030", "CSAFPID-5765031", "CSAFPID-5765032", "CSAFPID-5765033", "CSAFPID-5765034", "CSAFPID-5765035", "CSAFPID-5765036", "CSAFPID-5765037", "CSAFPID-5765038", "CSAFPID-5765039", "CSAFPID-5765040", "CSAFPID-5765041", "CSAFPID-5765042", "CSAFPID-5765043", "CSAFPID-5765044", "CSAFPID-5765045", "CSAFPID-5765046", "CSAFPID-5765047", "CSAFPID-5765048", "CSAFPID-5765049", "CSAFPID-5765050", "CSAFPID-5765051", "CSAFPID-5765052", "CSAFPID-5765053", "CSAFPID-5765054", "CSAFPID-5765055", "CSAFPID-5765056", "CSAFPID-5765057", "CSAFPID-5765058", "CSAFPID-5765059", "CSAFPID-5765060", "CSAFPID-5765061", "CSAFPID-5765062", "CSAFPID-5765063", "CSAFPID-5765064", "CSAFPID-5765065", "CSAFPID-5765066", "CSAFPID-5765067", "CSAFPID-5765068", "CSAFPID-5765069", "CSAFPID-5765070", "CSAFPID-5765071", "CSAFPID-5765072", "CSAFPID-5765073", "CSAFPID-5765074", "CSAFPID-5765075", "CSAFPID-5765076", "CSAFPID-5765077", "CSAFPID-5765078", "CSAFPID-5765079", "CSAFPID-5765080", "CSAFPID-5765081", "CSAFPID-5765082", "CSAFPID-5765083", "CSAFPID-5765084", "CSAFPID-5765085", "CSAFPID-5765086", "CSAFPID-5765087", "CSAFPID-5765088", "CSAFPID-5765089", "CSAFPID-5765090", "CSAFPID-5765091", "CSAFPID-5765092", "CSAFPID-5765093", "CSAFPID-5765094", "CSAFPID-5765095", "CSAFPID-5765096", "CSAFPID-5765097", "CSAFPID-5765098", "CSAFPID-5765099", "CSAFPID-5765100", "CSAFPID-5765101", "CSAFPID-5765102", "CSAFPID-5846584", "CSAFPID-5846585", "CSAFPID-5846586", "CSAFPID-5846587", "CSAFPID-5846588", "CSAFPID-5846589", "CSAFPID-5846590", "CSAFPID-5875707" ] } ], "title": "CVE-2026-33010" } ] }