CVE-2026-103068: Incorrect Privilege Assignment

Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools = 1.2.2 versions...

PT-2026-105837

Summary The OAuth token fallback file storage in OAuthConfig. save tokens to file creates token files containing access tokens, refresh tokens, and cloud IDs with default filesystem permissions typically 0644 on Linux, world-readable. Any local user on a shared system can read these files to obta...

CVE-2025-71427: Improper Limitation of a Pathname to a Restricted Directory

Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can steer an AI agent via prompt injection to abuse savepresentation,...

PT-2026-104054

Name of the Vulnerable Software and Affected Versions Office-PowerPoint-MCP-Server versions prior to 2.0.8 Description A path traversal issue allows callers to read and write files outside the intended working directory by using absolute paths or ../ sequences. An attacker can use prompt injectio...

PT-2026-103667

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...

PT-2026-103715

Name of the Vulnerable Software and Affected Versions ByteCoreStack – MCP Connector for AI Tools versions prior to 1.2.4 Description Authenticated users with Subscriber-level access or higher can elevate their privileges to Administrator. The issue exists in the execute tool function within the w...

CVE-2026-19807: Improper Privilege Management

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

PT-2026-105823

A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/ experimental/mcp server/auth/user api key auth mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be...

PT-2026-105848

Environment - Project: sooperset/mcp-atlassian - Affected function: validate url for ssrf - Affected path: header-based Jira/Confluence URL authentication flow - Tested endpoint: POST /mcp - Tested version: 2.14.5 Description The SSRF protection in validate url for ssrf can be bypassed with a URL...

PT-2026-105835

Summary A critical Confused Deputy Arbitrary File Read & Exfiltration vulnerability in the Atlassian MCP server Python allows an AI agent to exfiltrate sensitive host files and environment secrets. By providing absolute system paths to the attachments parameter of the update issue tool, an agent...

PT-2026-105843

Summary The upload attachment method in confluence/attachments.py reads and uploads arbitrary local files to Confluence without calling validate safe path. Both download methods download attachment at line 223, download content attachments at line 272 correctly call validate safe path before...

PT-2026-105839

Summary The UserTokenMiddleware extracts URLs from X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers and passes them directly to API client constructors without any SSRF validation. Affected Package - Ecosystem: PyPI - Package: mcp-atlassian - Affected versions: all versions before...

PT-2026-105825

A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function load openapi spec async of the file litellm/proxy/ experimental/mcp server/openapi to mcp generator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument spec pa...

PT-2026-105851

Summary MCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the M...

PT-2026-105858

Summary In SSE/HTTP transport mode, mysql mcp server constructs SseServerTransport without passing security settings. As a result, the MCP Python SDK's DNS-rebinding protection Origin/Host header validation is disabled; the Starlette application has no CORS or TrustedHost middleware; and the...

PT-2026-105853

Summary The mcp-atlassian server exposes an MCP tool confluence upload attachment and the Jira attachment variant that accepts an arbitrary server-side file path and opens it for upload without any path validation. When the server is deployed in HTTP transport mode streamable-http or sse, a remot...

PT-2026-105805

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...

PT-2026-105852

Summary mcp-atlassian is a popular community MCP server wrapper exposing Jira / Confluence to MCP clients. Operators commonly restrict the surface to a small allowlist of projects/spaces via the JIRA PROJECTS FILTER and CONFLUENCE SPACES FILTER environment variables, which the README documents as...

CVE-2026-97662: Improper Neutralization of Argument Delimiters in a Command

An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to...

PT-2026-105850

sooperset/mcp-atlassian: HTTP upload tools can attach arbitrary server-local files Date: 2026-05-05 Target: sooperset/mcp-atlassian Commit: d8bc78698a63cb6b321c7ca796d6329d448f7f6d Summary mcp-atlassian supports HTTP/SSE deployment for persistent, remote, and multi-user use. In that mode,...