149389 matches found
MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler
Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...
CVE-2026-96259
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x
CVE-2019-0708-Batch-Blue-Screen
CVE-2019-0708-Batch-Blue-Screen Modified version of a blue screen script by an expert, changed to batch blue screen for a network segment. Usage: root@kitploit: python3 poc.py 192.168.20 64 Batch attacks hosts 1-255 in the 192.168.20 network segment to cause blue screens. Modify accordingly based...
OpenCVE: Server-Side Request Forgery (SSRF) in notifications
Impact OpenCVE contains a Server-Side Request Forgery SSRF vulnerability in the notification testing functionality for both Webhook and Slack integrations. An authenticated user with permission to configure notification channels can trigger test requests to arbitrary HTTPS endpoints. Insufficient...
GHSA-CH3G-4XVR-674Q OpenCVE: Server-Side Request Forgery (SSRF) in notifications
Impact OpenCVE contains a Server-Side Request Forgery SSRF vulnerability in the notification testing functionality for both Webhook and Slack integrations. An authenticated user with permission to configure notification channels can trigger test requests to arbitrary HTTPS endpoints. Insufficient...
HeartBleed
HeartBleed vulnerability in docker 1. git clone https://github.com/Saymeis/HeartBleed.git 2. cd HeartBleed 3. sudo docker build -t heartbleed -f Dockerfile . 4. sudo docker run -p 80:80 -p 443:443 -d heartbleed...
GHSA-M8F5-RH7H-VGG3 microsandbox: Secret values exposed in world-readable process arguments
Summary When the SDK spawns a sandbox, the msb sandbox child process receives the full network configuration as an inline --network-config command-line argument, and any per-sandbox environment as repeated --env KEY=VALUE arguments. On Linux a process's arguments are world-readable via...
CVE-2026-95861
A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...
CVE-2026-95862
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...
CVE-2026-91129
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...
CVE-2026-77555
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...
CVE-2026-77556
A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...
CVE-2026-77558
A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...
CVE-2026-77544
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...
CVE-2026-77248
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while uploadattachment accepts an unrestricted filepath. An...
CVE-2026-76712
A vulnerability exists in the HPE Networking Analytics and Location Engine (ALE) that may allow an unauthenticated remote attacker to gain unauthorized access , cause information disclosure , or trigger a denial of service . The vulnerability can be exploited by sending specially crafted input or...
CVE-2026-91129 Home Assistant: mDNS Server-Side Request Forgery
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...
CVE-2026-91129
The Home Assistant home automation software is vulnerable to a Server-Side Request Forgery (SSRF) flaw in the IPP integration (specifically within homeassistant/components/ipp/config_flow.py). Prior to version 2026.2.3 , the async_step_zeroconf function automatically processed unauthenticated _ip...
