Reported issues

Each issue is counted once, with its other IDs listed under it. "Listed version" means the version the registry lists: "Not flagged" means OSV doesn't mark it as affected, and "Not checked" means the source gives no version we can compare.

IssueSeverityListed versionReported
CVE-2026-62264PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server, `@sylphx/pdf-reader-mcp` reads `MCP_API_KEY` and logs that `X-API-Key`… high Not checked Oct 30, 2026

Versions in the registry

8.5.11 (listed), 8.5.10, 8.5.9, 8.5.7, 8.5.6, 8.5.5, 8.5.4, 8.5.3, 8.5.1, 8.5.0, 8.4.0, 8.3.0, 8.2.0, 8.1.0, 8.0.0, 7.1.1, 7.1.0, 7.0.0