10 CVEs, remote code execution on platforms and individual developer's workstations. The public announcement is three days old and I couldn't find any mention here, which is kind of surprising.

Submission title here is the HTML title. Visible title in the article "The Mother of All AI Supply Chains: Critical, Systemic Vulnerability at the Core of Anthropic’s MCP"