jlowin records
6 published records for vendor jlowin.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')2
- CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')1
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1
- CWE-863 Incorrect Authorization1
- CWE-918 Server-Side Request Forgery (SSRF)1
The weakness classes this vendor ships most often: where to look.
CWEAll records
6 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
40Plan | CVE-2026-32871No exploit | FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerabilityjlowin · fastmcp · CWE-918 | Critical10.0 | 0.9%Apr 2, 2026 |
32Monitor | CVE-2026-27124No exploit | FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilitiesjlowin · fastmcp · CWE-441 | High8.2 | 0.2%Apr 3, 2026 |
31Monitor | CVE-2025-64340No exploit | FastMCP has a Command Injection vulnerability - Gemini CLIjlowin · fastmcp · CWE-78 | High7.8 | 0.7%Apr 3, 2026 |
29Monitor | CVE-2025-69196No exploit | FastMCP OAuth Proxy token reuse across MCP serversjlowin · fastmcp · CWE-863 | High7.4 | 0.4%Mar 16, 2026 |
21Monitor | CVE-2025-62800No exploit | FastMCP vulnerable to reflected XSS in client's callback pagejlowin · fastmcp · CWE-79 | Medium5.3 | 0.2%Oct 28, 2025 |
21Monitor | CVE-2025-62801No exploit | FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_namejlowin · fastmcp · CWE-78 | Medium5.4 | 0.2%Oct 28, 2025 |
- CVE-2026-3287140Plan
FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
CriticalCVSS 10.0No exploitEPSS 0%jlowin · fastmcpApr 2, 2026
- CVE-2026-2712432Monitor
FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities
HighCVSS 8.2No exploitEPSS 0%jlowin · fastmcpApr 3, 2026
- CVE-2025-6434031Monitor
FastMCP has a Command Injection vulnerability - Gemini CLI
HighCVSS 7.8No exploitEPSS 0%jlowin · fastmcpApr 3, 2026
- CVE-2025-6919629Monitor
FastMCP OAuth Proxy token reuse across MCP servers
HighCVSS 7.4No exploitEPSS 0%jlowin · fastmcpMar 16, 2026
- CVE-2025-6280021Monitor
FastMCP vulnerable to reflected XSS in client's callback page
MediumCVSS 5.3No exploitEPSS 0%jlowin · fastmcpOct 28, 2025
- CVE-2025-6280121Monitor
FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name
MediumCVSS 5.4No exploitEPSS 0%jlowin · fastmcpOct 28, 2025