Reported issues

Each issue is counted once, with its other IDs listed under it. "Listed version" means the version the registry lists: "Not flagged" means OSV doesn't mark it as affected, and "Not checked" means the source gives no version we can compare.

IssueSeverityListed versionReported
CVE-2026-81098The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication h… critical Not checked Aug 27, 2026

Versions in the registry

6.29.3 (listed), 3.3.3