- Latest release
- 12.7.0 (Nov 7, 2026): no advisory affects it
- Newest unaffected release
- 12.7.0 (Nov 7, 2026), the latest release
- Advisories
- 4 · 1 critical, 2 high, 1 medium
- Weekly downloads
- 1,459
- Dependents
- 0
- Releases
- 346 since 8.24.0 (Nov 12, 2025)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-50027Affects 8.24.0 to 10.67.0 (10.67.1 is outside it)
- CVE-2026-49291Affects 8.24.0 to 10.65.1 (10.65.3 is outside it)
- CVE-2026-33010Affects 8.24.0 to 10.25.0 (10.25.1 is outside it)
- CVE-2026-29787Affects 8.24.0 to 10.20.6 (10.21.0 is outside it)
Advisories 4
- CVE-2026-50027Critical 9.8
mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete
Affected: fixed in 10.67.1.
Fixed in 10.67.1 (released May 28, 2026, 78 days before disclosure).
The latest release, 12.7.0, is not affected.
- CVE-2026-49291High 8.1
mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call
Affected: fixed in 10.65.3.
Fixed in 10.65.3 (released May 25, 2026, 25 days before disclosure).
The latest release, 12.7.0, is not affected.
- CVE-2026-33010High 8.1
mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft
Affected: fixed in 10.25.1.
Fixed in 10.25.1 (released Mar 6, 2026, 14 days before disclosure).
The latest release, 12.7.0, is not affected.
- CVE-2026-29787Medium 5.3
mcp-memory-service: System Information Disclosure via Health Endpoint
Affected: fixed in 10.21.0.
Fixed in 10.21.0 (released Mar 4, 2026, 3 days before disclosure).
The latest release, 12.7.0, is not affected.