MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

SummaryThe uploadattachment functions in both the Jira and Confluence modules accept a user-controlled filepath parameter and open the specified file for reading without calling validatesafepath. An authenticated MCP client can supply an arbitrary path such as /etc/passwd or /proc/self/environ,...

MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)

Summarymcp-atlassian exposes an MCP tool confluenceuploadattachment whose filepath argument is passed directly to openfilepath, "rb" without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exfiltrate them into a multipart upload...

MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

SummaryMCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the MC...

MPXJ: XXE Vulnerability in MerlinReader

ImpactMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file...

MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

SummaryIn the documented multi-user HTTP deployment --transport streamable-http with global operator Atlassian credentials, sooperset/mcp-atlassian exposes all tools to unauthenticated network clients, and the uploadattachment tool reads an attacker-supplied filepath with no path validation...

MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

ImpactWhen reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. PatchesThis issue is addressed in MPXJ version 16.5.0. WorkaroundsDo not read PRX or STX files from untrusted sources...

LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

Summarylmdeploy = latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantizationconfig.quantdtype value. When a user loads the model with lmdeplo...

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

ImpactThe djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its top-level code import side effects — before the framework checks that the resolved object is a LiveView subclass and before any...

sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...

CVE-2026-102826

A flaw was found in simple-git. The library fails to properly sanitize Git configuration directives passed through custom clone arguments, which allows Git to load an attacker-controlled configuration file. By specifying executable settings within that configuration, an attacker can achieve...

CVE-2026-102505

A flaw was found in perl-Imager. When processing floating-point samples from a paletted image, the application allocates an undersized buffer for multi-channel requests. An attacker could provide a specially crafted image to trigger a heap-based buffer overflow with controlled data, potentially...

ServiceNow-CVE-2025-11449-CVE-2025-11450-Mitigation-Script

ServiceNow CVE-2025-11449 및 CVE-2025-11450 완화 스크립트 개요 이 스크립트는 ServiceNow UI 매크로에서 CVE-2025-11449 및 CVE-2025-11450 보안 취약점을 자동으로 탐지하고 수정합니다. 이러한 취약점은 사용자가 제어하는 sysparm 매개변수가 제대로 삭제되지 않을 경우 특수하게 제작된 링크를 통해 사용자 브라우저에서 임의 코드 실행을 허용할 수 있습니다. 영향을 받는 UI 매크로 $pwdverifyemail $pwdverifypersonaldataui 이 스크립트...

CVE-2026-1357

CVE-2026-1357 CVE-2026-1357 실습 환경 1. 환경 구축 sudo apt update && sudo apt install docker.io docker-compose -y sudo systemctl start docker git clone 저장소 링크 wget https://downloads.wordpress.org/plugin/wpvivid-backuprestore.0.9.123.zip unzip wpvivid-backuprestore.0.9.123.zip sudo docker-compose up -d...

CVE-2026-31280-Insecure-Bluetooth-RFCOMM-Leading-to-Device-Crash-in-Parani-M10-Intercom

CVE-2026-31280-Insecure-Bluetooth-RFCOMM-Leading-to-Device-Crash-in-Parani-M10-Intercom Parani M10 인터콤의 Bluetooth Classic RFCOMM 서비스는 보안 인증 또는 적절한 접근 제어를 적용하지 않은 채 노출되어 있습니다. 범위 내에 있으면 어떤 장치든 적절한 페어링 제한 없이 연결을 설정하고, RFCOMM 채널에 직접 접근하거나 임의 또는 변조된 페이로드를 전송할 수 있습니다. 이 취약점에 대한 개념 증명PoC은 첨부된 PDF에 문서화되...

CVE-2020-8193

Citrix ADC Vulns CVE List https://support.citrix.com/article/CTX276688 Add if while Code https://dmaasland.github.io/posts/citrix.html responsestr = json.dumpsr.headers.dict'store' if r.statuscode == 406 and "Content-Disposition" in responsestr and r.headers"Accept-Ranges" == "bytes" and...

CVE-2026-92867

A flaw was found in Pgpool-II. An out-of-bounds write vulnerability allows an authenticated remote attacker to corrupt memory. This issue may enable the attacker to achieve arbitrary code execution or trigger an abnormal process crash, resulting in a denial of service DoS. Mitigation Disable the...

CVE-2026-40487

CVE-2026-40487 - Postiz 서버가 Content-Type 헤더만 검증 CWE-345 - 파일이 원래 .svg 확장자로 디스크에 저장됨 CWE-434 - nginx가 image/svg+xml로 제공 - 브라우저가 임베디드 JavaScript 실행 CWE-79 - 동일 오리진: 피해자 세션에 대한 완전한 접근 권한 영향 XSS 페이로드는...

CVE-2024-12986

CVE-2024-12986 스캐너 및 익스플로잇 이 저장소는 DrayTek 게이트웨이 장치 의 apmcfgupptim 엔드포인트에서 발생하는 명령 주입 취약점 인 CVE-2024-12986 에 대한 스캐너와 익스플로잇을 포함합니다. 이 취약점은 공격자가 영향을 받는 장치에서 임의의 명령을 실행할 수 있게 하여, 잠재적으로 전체 시스템을 장악할 수 있습니다. 취약점 개요 이 취약점은 DrayTek 게이트웨이 장치의 apmcfgupptim 엔드포인트에 존재합니다. 악의적인 HTTP 요청을 구성함으로써, 공격자는 session...

CVE-2026-3844

CVE-2026-3844 Breeze Cache ≤ 2.4.4 - 인증 없는 임의 파일 업로드 ⚠️ 면책 조항 이 도구는 교육 및 보안 연구 목적으로만 제공됩니다. 승인되지 않은 컴퓨터 시스템 접근은 불법입니다. 이 도구는 소유한 시스템이나 명시적 테스트 허가를 받은 시스템에서만 사용하십시오. 저자는 이 소프트웨어로 인한 오용 또는 손해에 대해 어떠한 책임도 지지 않습니다. 📋 설명 CVE-2026-3844는 WordPress용 Breeze Cache 플러그인버전 ≤ 2.4.4의 심각한 인증 없는 임의 파일 업로드 취약점입니다...

CVE-2026-24294

CVE-2026-24294 - 通过 SMB 任意端口实现本地 NTLM 反射提权 通过 NTLM 反射在 Windows Server 2025 上实现本地权限提升，利用 Windows 11 24H2 / Server 2025 中引入的 SMB 任意端口功能。 漏洞详情 Windows 11 24H2 / Server 2025 引入了一项 SMB 客户端功能，允许在任意 TCP 端口上建立连接（net use \host\share /tcpport:PORT）。结合 SMB 会话多路复用（MS-SMB2 第 3.2.4.2 节），这实现了本地 NTLM...