EUVD-2026-84950

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal...

CVE-2026-6925: Improper Limitation of a Pathname to a Restricted Directory

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

CVE-2026-6718: Incorrect Default Permissions

IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...

WordPress 7.1.1 Local File Inclusion Scanner

WordPress versions 4.7.0 through 7.1.1 contain an unauthenticated page-template path traversal issue that can include readable local PHP files. This tool probes the wp-links-opml.php inclusion oracle without attempting command execution...

PT-2026-97591

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description A remote attacker can perform directory traversal on the system by sending a specially crafted URL request containing dot-dot-slash /../ sequences. This allows the attacker to view arbitrary...

EUVD-2026-85402

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

ROS-20260923-73-0001

The vulnerability of the services/repository/files/patch.go file in the Git repository management system Gitea is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and gain unauthorized access to protected information...

The vulnerability of the `NioPathHelper.deserialize` method in the Jackson-Databind library allows a hacker to load arbitrary files.

The vulnerability of the NioPathHelper.deserialize method in the Jackson-Databind library is related to insecure dynamic class loading. Exploiting this vulnerability could allow an attacker to load arbitrary files...

PT-2026-97160

Name of the Vulnerable Software and Affected Versions YAHMAN Add-ons WordPress plugin versions prior to 0.9.31 Description The plugin fails to validate the type of remote files it caches within a publicly accessible directory. This allows unauthenticated attackers to write arbitrary PHP files to...

MAL-2026-16410 Malicious code in auclean (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535d1083af63653f3cc6befeffe23a6fd97cea9b183b95eac92779a5abcdcd9d The pip install of auclean 0.4.2 runs a custom setup.py buildpy command that chmod 0755's and executes a 1.8MB bundled Rust ELF binary...

Server-side Request Forgery (SSRF)

Overview mcp-atlassian is a The Model Context Protocol MCP Atlassian integration is an open-source implementation that bridges Atlassian products Jira and Confluence with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with...

Server-side Request Forgery (SSRF)

Overview mcp-atlassian is a The Model Context Protocol MCP Atlassian integration is an open-source implementation that bridges Atlassian products Jira and Confluence with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with...

Server-side Request Forgery (SSRF)

Overview mcp-atlassian is a The Model Context Protocol MCP Atlassian integration is an open-source implementation that bridges Atlassian products Jira and Confluence with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with...

CVE-2026-88341

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration numbuffers=0 that triggers an assertion failure in yrarenagetptr, causing the application to terminate...

Server-side Request Forgery (SSRF)

Overview mcp-atlassian is a The Model Context Protocol MCP Atlassian integration is an open-source implementation that bridges Atlassian products Jira and Confluence with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with...

CVE-2026-77262 MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment accepts an attacker-controlled filepath and does not apply the path restriction added for the earlier download vulnerability. A caller can traverse outside...

CVE-2026-77253 MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the...

SUSE CVE-2026-91202

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link symlink and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory,...

SUSE CVE-2026-91203

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...

SUSE CVE-2026-91205

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link symlink before the ownership change...