Linux Distros Unpatched Vulnerability : CVE-2026-101907

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An...

CVE-2026-101907

A flaw was found in Axios. When configured to use the fetch adapter, the application does not enforce settings configured to disable HTTP redirects. A remote attacker controlling a redirecting server can exploit this behavior to force the application to follow redirects to internal endpoints,...

CVE-2026-101907

Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation...

UBUNTU-CVE-2026-101907

Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation...

CVE-2026-101907: Unintended Proxy or Intermediary

Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation...

PoC-CVE-2025-52913

CVE-2025-52913 - MiCollab Path Normalization Vulnerability 📌 Overview This repository contains a Proof of Concept PoC for CVE-2025-52913 , a path normalization vulnerability affecting Mitel MiCollab. The issue allows unauthenticated attackers to bypass intended path restrictions by leveraging...

CVE-2026-76710

A vulnerability exists in the Analytics and Location Engine ALE management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful...

CVE-2026-76710 Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in the Analytics and Location Engine ALE management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful...

EUVD-2026-84670

A vulnerability exists in the Analytics and Location Engine ALE management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful...

CVE-2026-76710 Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in the Analytics and Location Engine ALE management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful...

CVE-2026-76710

A vulnerability in the HPE Networking Analytics and Location Engine (ALE) management interface allows an unauthenticated remote attacker to disclose sensitive information. By sending specially crafted requests to specific internal endpoints, an attacker can gain access to site hierarchy , infrast...

CVE-2026-77242

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validateurlforssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting. A caller can use a short-lived DNS answer that is publi...

EUVD-2026-84627

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validateurlforssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting. A caller can use a short-lived DNS answer that is publi...

CVE-2026-77242 MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validateurlforssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting. A caller can use a short-lived DNS answer that is publi...

CVE-2026-76710: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability exists in the Analytics and Location Engine ALE management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful...

PT-2026-96923

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The software is susceptible to Server-Side Request Forgery SSRF, a condition where an attacker can induce the server to make requests to an unintended location. The validate url for ssrf...

CVE-2026-59823

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place apibase inside the userconfig request body to bypass isrequestbodysafe, which blocks top-level apibase and baseurl but...

CVE-2026-82837

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to...

EUVD-2026-78907

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to...

CVE-2026-82837

GitLab CE/EE is affected by an insufficiently protected credentials issue in the Workhorse senddata emitters (internal data emission endpoints). Due to improper authorization checks, an authenticated user could access sensitive credentials and tokens without transiting the expected proxy. The iss...