MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)

Summary mcp-atlassian is a popular community MCP server wrapper exposing Jira / Confluence to MCP clients. Operators commonly restrict the surface to a small allowlist of projects/spaces via the JIRAPROJECTSFILTER and CONFLUENCESPACESFILTER environment variables, which the README documents as the...

CVE-2026-77251 MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira search accepts a forbidden project clause because it checks only for the presence of project syntax, Confluence search uses an incomplete case-sensitive space check, and Jira boa...

CVE-2026-77251 MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira search accepts a forbidden project clause because it checks only for the presence of project syntax, Confluence search uses an incomplete case-sensitive space check, and Jira boa...

CVE-2026-91081: Server-Side Request Forgery (SSRF)

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...

django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

ImpactThe only authorization gate on the duplicate flow is PageAdmin.hasaddpermission,which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “maythis user create a page at all”. Nothing checks the user’s relationship to the page beingcopied:- cms/admin/forms.py —...

PYSEC-2026-3821 django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

Impact The only authorization gate on the duplicate flow is PageAdmin.hasaddpermission, which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...

django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

Impact The only authorization gate on the duplicate flow is PageAdmin.hasaddpermission, which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...

GHSA-6X92-6VX4-5FWR django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

Impact The only authorization gate on the duplicate flow is PageAdmin.hasaddpermission, which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...

CVE-2026-57511: Improper Neutralization of CRLF Sequences

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SM...

CVE-2026-65707 Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral,...

CVE-2026-32704

SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes. Thi...

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Update to Mozilla Thunderbird 140.7.1 MFSA 2026-08 bsc1257397: CVE-2026-0818: CSS-based exfiltration of the content from partially encrypted emails when allowing remote content Patch Instructions: To install this SUSE update use the...

SUSE-SU-2026:0388-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Update to Mozilla Thunderbird 140.7.1 MFSA 2026-08 bsc1257397: - CVE-2026-0818: CSS-based exfiltration of the content from partially encrypted emails when allowing remote content...

PT-2026-5077

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 147.0.1 Thunderbird versions prior to 140.7.1 Description A flaw exists that could allow for CSS-based exfiltration of content from partially encrypted emails when remote content is permitted. This could potential...

CVE-2025-62614: Missing Authorization

BookLore is a self-hosted web app for organizing and managing personal book collections. In versions 1.8.1 and prior, an authentication bypass vulnerability in the BookMediaController allows any unauthenticated user to access and download book covers, thumbnails, and complete PDF/CBX page content...

FreeBSD : Gitlab -- Vulnerabilities (1a8c5720-e9cf-11ef-9e96-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1a8c5720-e9cf-11ef-9e96-2cf05da270f3 advisory. Gitlab reports: A CSP-bypass XSS in merge-request page Denial of Service due to Unbounded Symb...

CVE-2021-24928

The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the saveallorder AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to...

CVE-2018-11307

A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using MyBatis classes when using DefaultTyping. An attacker could use this flaw to achieve content exfiltration and possibly conduct further attacks...

Researchers Find New Hack to Read Content Of Password Protected PDF Files

Looking for ways to unlock and read the content of an encrypted PDF without knowing the password? Well, that's now possible, sort of—thanks to a novel set of attacking techniques that could allow attackers to access the entire content of a password-protected or encrypted PDF file, but under some...

jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis

A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using MyBatis classes when using DefaultTyping. An attacker could use this flaw to achieve content exfiltration and possibly conduct further attacks...