EUVD-2026-57823

GitPython before 3.1.57 contains an incomplete denylist in the unsafegitarchiveoptions guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive to read arbitrary files from the filesystem and include them in the returned archive...

CVE-2026-73619 GitPython before 3.1.57 Arbitrary File Read via Repo.archive()

GitPython before 3.1.57 contains an incomplete denylist in the unsafegitarchiveoptions guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive to read arbitrary files from the filesystem and include them in the returned archive...

CVE-2026-73619

GitPython before 3.1.57 contains an incomplete denylist in the unsafegitarchiveoptions guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive to read arbitrary files from the filesystem and include them in the returned archive...

PT-2026-71871

Name of the Vulnerable Software and Affected Versions Vault Secrets Operator versions 1.3.0 through 1.4.1 Description An arbitrary file read and credential exfiltration issue exists in the AppRole authentication configuration. This allows a tenant with limited Kubernetes RBAC Role-Based Access...

PT-2026-71704

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON reques...

PT-2026-71737

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

PT-2026-71635

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A symlink race condition exists in the sender's source tree traversal. An attacker capable of manipulating a parent directory of the source tree can redirect file reads to unintended paths. This is...

PT-2026-71640

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description An arbitrary file read issue exists due to improper symlink following during the handling of input configuration files. Attackers can read files accessible to the rsync daemon process by placing a...

Linux Distros Unpatched Vulnerability : CVE-2026-16033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata...

Linux Distros Unpatched Vulnerability : CVE-2026-63293

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an...

CVE-2026-73498

creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:05+00:00| published-proof-of-concept| https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-g5r6-gv6m-f5jv 2026-08-12 23:01:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mswacrdtft22...

CVE-2026-73498

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...

CVE-2026-64826

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the downloadexport method. Attackers can craft requests with ../ sequences to escape th...

CVE-2026-16033

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...

EUVD-2026-57639

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...

CVE-2026-73498

The MCP Atlassian MCP server (Confluence/Jira) is affected by an arbitrary file read in confluence_upload_attachment prior to version 0.22.0. The function passes a client-supplied file_path directly to open(file_path, "rb") via _upload_attachment_direct() without validating the path, allowing an ...

CVE-2026-73498 MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachment

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...

CVE-2026-73498

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...

CVE-2026-73498 MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachment

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...

CVE-2026-73498 MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachment

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...