CVE-2026-73498 MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachment

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...

CVE-2026-73519 WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the requireauth gate...

GHSA-QVW7-JM5C-6HQW vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

CVE-2026-19502

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

CVE-2026-19502

CVE-2026-19502 affects MongoDB SQL Schema Builder CLI. The issue is insufficient redaction of sensitive startup/connection configuration in diagnostic output (stdout and log files), allowing a local user with access to terminals or logs to view authentication material. The documentation provided ...

CVE-2026-19502 Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

CVE-2026-16694 IBM i is Affected By Stored Cross-site Scripting for i

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2026-16694 IBM i is Affected By Stored Cross-site Scripting for i

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PYSEC-2026-3993

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-65017

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-68448

A flaw was found in the Linux kernel's overlayfs component. When copying files across different overlay filesystems, the system incorrectly checked read permissions using the destination filesystem's credentials instead of the source's. This oversight could allow an unauthorized user to read file...

CVE-2026-65017

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

EUVD-2026-57265

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...

MAL-2026-13806 Malicious code in egypt0811 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77d31e1b5baa802662cbb61387f5c3b759d159e74e8776d9515198db5c168074 The package contains only index.html declared as main with no JavaScript modules, no lifecycle scripts preinstall/install/postinstall, and no bin...

Malicious code in hcfguyfrmblp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f806fc6db71a1b888ba1f86d790b7a2866b4911e7f77ade2d375237e8c0a6ea2 The tarball contains only package.json and index.html, with no lifecycle scripts and main set to index.html. The HTML page mimics a Cloudflare...

Malicious code in mnhdjoweuq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 095b631b3ea82334aa5d3ffb4c015340670beebb533d0e016023d997a3ce7e56 Package contains only package.json and index.html, with main pointing at the HTML file. index.html mimics a Cloudflare Turnstile 'Just a moment'...

MAL-2026-13816 Malicious code in hxckdoeaqjlc8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d324cd3fd06a0d97ae5fb9263df818bc505d28ebcdda8e90814b5630de70e108 The package ships a single HTML file that impersonates Cloudflare's 'Just a moment...' interstitial. On Turnstile widget callback, embedded JavaScrip...

MAL-2026-13808 Malicious code in fghvbmniwu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8623e3b9a84e8cbe5910bc3d683f19629c49b9d3f0a2e00ab771901efef8146a Package contains a single index.html declared as main, which is a Cloudflare-branded 'Just a moment...' clone embedding a Turnstile widget and heavil...

MAL-2026-13802 Malicious code in dhjksficgwu2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5dc64d0022ee36cd898963db50e3c835990bf94837821fb34408820855c69c0 Package contains a single index.html file declared as main. The HTML impersonates a Cloudflare Turnstile 'Just a moment...' verification page sitekey...