PT-2026-97620

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.6 through 19.2.6 GitLab CE/EE versions 19.3 through 19.3.2 GitLab CE/EE versions 19.4 Description A race condition exists in the shared state handling of the MCP search tool. This occurs when multiple processes access ...

Malicious code in @tvg-mar/promos-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68c9eeb2e4516c9cab13b7e00458e54cccac15ab6c28eda25b2138ceeeab60f3 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. On every npm install, that module...

MAL-2026-16412 Malicious code in @tvg-mar/promos-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68c9eeb2e4516c9cab13b7e00458e54cccac15ab6c28eda25b2138ceeeab60f3 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. On every npm install, that module...

CVE-2026-15915 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of build context directories into container images...

CVE-2026-15915 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of build context directories into container images...

CVE-2026-15915

IBM Concert versions 1.0.0 through 3.0.0 are susceptible to a vulnerability where a local attacker can obtain sensitive information . This is caused by the recursive copying of build context directories into container images. No specific remediation, exploit details, or in-the-wild exploitation r...

CVE-2026-77255

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira updateissue attachments argument is converted into local paths and routed to the attachment upload implementation without workspace validation. A caller can make the MCP serv...

CVE-2026-85288

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WMMACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback without the validation used by command. A tampered shortcuts.xml macro...

Malicious Package

Overview @tvg-mar/promos-context is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview @wizloft/harness-plugin-memory-context is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

CVE-2026-77243 MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, ENABLEDTOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that knows a hidden tool name can directly invoke...

CVE-2026-77267 mcp-atlassian has an incomplete SSRF remediation

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by processauthenticationheaders and used to construct Atlassian fetchers without calling...

CVE-2026-77267 mcp-atlassian has an incomplete SSRF remediation

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by processauthenticationheaders and used to construct Atlassian fetchers without calling...

CVE-2026-77270 MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled filepath values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassia...

SUSE CVE-2026-90381

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix handling channel context with different bands in mt76switchvifchanctx When performing channel switches on different radios within a short timeframe, channel contexts with different bands can be carried for each...

SUSE CVE-2026-92574

A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, nonewprivs, and seccomp state from the checkpoint instead ...

SUSE CVE-2026-93096

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mboxmutex only serializes individual mailbox commands and is...

Day-22--Reflected-Cross-Site-Scripting-XSS-in-HTML-Context

Day 22: Reflected Cross-Site Scripting XSS in HTML Context...

ROS-20260922-73-0059

The vulnerability of the BTFID function in the kernel/bpf/bpflsm.c module, which is part of the Linux operating system’s BPF interpreter support, relates to the use of an unrecoverable function in a parallel context. Exploiting this vulnerability could allow an attacker to compromise the...

PT-2026-97062

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description A local attacker can obtain sensitive information because build context directories are recursively copied into container images. Recommendations Update IBM Concert to a version newer than...