ROS-20260923-73-0029

The vulnerability of the drivers/net/ethernet/intel/ixgbevf component in Linux operating systems is related to errors during resource release. Exploiting this vulnerability can allow an attacker to cause service failures...

PT-2026-97366

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An administrative user can obtain sensitive information when the browser returns a detailed technical error message. This exposure of internal data could be leveraged to facilitate further...

ROS-20260923-73-0036

The vulnerability of the etmsetupaux function in the Linux operating system’s kernel is related to a pointer arithmetic error. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20260923-73-0099

The vulnerability of the drivers/uio/uiohvgeneric.c module in Linux kernels is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause service failures...

ROS-20260923-73-0011

The vulnerabilities of the functions nvmettcpbuildpduiovec and nvmettcphandlereqfailure in the driver/nvme/target/tcp.c module of the Linux kernel are related to error handling flaws. Exploiting these vulnerabilities allows a remote attacker to compromise the confidentiality, integrity, and...

PT-2026-97365

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description A remote attacker can obtain sensitive information when the system returns detailed technical error messages in the browser. This exposure of internal data could be leveraged to facilitate...

ROS-20260923-73-0033

The vulnerability of the netdevallocskbipalign function in the Linux operating system is related to a pointer arithmetic error. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260923-73-0037

The vulnerability of the platformgetresource function in the Linux operating system’s kernel is related to pointer arithmetic errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

Debian dla-4791 : memcached - security update

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4791 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4791-1 [email protected]...

PT-2026-97525

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20 Description The native marketplace implementation contains a logic error where the Buy function in core/kapp/market/market.go fails to verify the IsClaimed status of an order. This allows a seller to settle a...

CVE-2026-86049

A flaw was found in Jupyter Server. The server's logging mechanism for HTTP 500 errors fails to properly redact sensitive information. When a request results in an HTTP 500 error and includes a Referer header containing a security token, this token is written to server logs in plaintext. An...

GHSA-HRMJ-7RVJ-4HG8 lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration see companion report on CWE-306, any network-reachable client can trigger exceptions whos...

lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration see companion report on CWE-306, any network-reachable client can trigger exceptions whos...

MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

GHSA-G2R2-3J32-J27X MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

Cross-site Scripting (XSS)

Overview mcp-atlassian is a The Model Context Protocol MCP Atlassian integration is an open-source implementation that bridges Atlassian products Jira and Confluence with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with...

CVE-2026-77272 MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth error query parameter is passed to CallbackHandler.sendresponse in oauthsetup.py and interpolated into an HTML page without escaping. A crafted authorization callback can...

CVE-2026-77272 MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth error query parameter is passed to CallbackHandler.sendresponse in oauthsetup.py and interpolated into an HTML page without escaping. A crafted authorization callback can...

CVE-2026-77272

The mcp-atlassian MCP server for Confluence and Jira is vulnerable to Reflected XSS in versions prior to 0.22.0 . The root cause is the lack of input validation in oauth_setup.py, where the oauth error query parameter is passed to CallbackHandler._send_response and interpolated into an HTML page ...

CVE-2026-77272 MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth error query parameter is passed to CallbackHandler.sendresponse in oauthsetup.py and interpolated into an HTML page without escaping. A crafted authorization callback can...