CVE-2026-61570: Improper Restriction of XML External Entity Reference

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype...

CVE-2026-95698: Improper Limitation of a Pathname to a Restricted Directory

The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls fileexists on the resulting path. The organization name field is attacker-controllable through event...

PT-2026-96950

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description Missing path validation in the confluence upload attachment function allows an authenticated client to read arbitrary files from the server filesystem and exfiltrate their contents to a...

PT-2026-97085

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Improper path canonicalization allows a remote attacker to read arbitrary files. Path canonicalization is the process of converting a file...

PT-2026-96945

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the...

PT-2026-96769

The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls file exists on the resulting path. The organization name field is attacker-controllable through event...

PT-2026-96928

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description An arbitrary local file read issue exists in the Confluence and Jira upload attachment tool paths. The implementation accepts an unconstrained file path and opens the referenced server-local...

PT-2026-96954

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The confluence upload attachment and confluence upload attachments tools do not validate that the provided source path is confined to an allowed directory before opening the file. A caller can...

PT-2026-96835

Name of the Vulnerable Software and Affected Versions Nuclei versions 3.0.0 through 3.9.9 Description The workflow template loading path fails to enforce the -file capability gate when resolving templates using the file: protocol referenced by a workflow. This allows an untrusted, unsigned workfl...

PT-2026-96949

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description HTTP-exposed Jira and Confluence upload tools allow a remote caller to provide a file path that is passed to local file operations without being restricted to a specific workspace. This allows...

PT-2026-96943

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description In multi-user HTTP deployments using the --transport streamable-http configuration, the server exposes all tools to unauthenticated network clients. This occurs because the UserTokenMiddleware...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-091360)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091360 advisory. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled either globally or for a specific property f...

CVE-2026-61749 InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The...

CVE-2026-61749 InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The...

CVE-2026-61749

InvenTree is an open-source inventory management system. In versions prior to 1.4.0 , privileged staff users with the ability to author report or label templates can trigger WeasyPrint report rendering to fetch attacker-controlled resources via HTTP/HTTPS URL schemes or the local file URI scheme....

cve-2026-85706

CVE-2026-85706 — GitLab Unauthenticated Arbitrary File Read CVSS 10.0 · Unauthenticated · Actively exploited CISA KEV A parser differential between GitLab Workhorse Go reverse proxy and Puma/Grape Ruby lets an unauthenticated attacker bypass Workhorse's accelerated-upload handoff and reach three...

USN-8794-1: GLib vulnerabilities

It was discovered that GLib's GDBus authentication mechanism failed to enforce length limitations on data lines read from a client. An unauthenticated attacker could exploit this to cause a denial of service via resource exhaustion. CVE-2026-15588 It was discovered that the xdgmime library in GLi...

assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)

A flaw was found in AssertJ. An XML External Entity XXE vulnerability exists in the XmlStringPrettyFormatter component, which is used by the isXmlEqualToCharSequence assertion. If an application processes untrusted XML input using these methods, a remote attacker could exploit this flaw to read...

CVE-2026-94401

MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify...

CVE-2026-94401

MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify...