CVE-2026-77268

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bi...

CVE-2026-77268

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to insecure file permissions in versions prior to 0.22.0 . The application creates the OAuth fallback token directory and JSON file without explicit owner-only modes. This allows local users or processes with gr...

CVE-2026-77268 MCP Atlassian: Insecure File Permissions on OAuth Token Storage

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bi...

CVE-2026-77250

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, OAuthConfig writes a plaintext fallback file containing access and refresh tokens under the user's .mcp-atlassian directory using process-default permissions. On systems with a...

CVE-2026-77250

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable in versions prior to 0.22.0 . The OAuthConfig component writes a fallback file containing plaintext access and refresh tokens into the .mcp-atlassian directory using process-default permissions . On systems with...

CVE-2026-77250 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, OAuthConfig writes a plaintext fallback file containing access and refresh tokens under the user's .mcp-atlassian directory using process-default permissions. On systems with a...

CVE-2026-77250 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, OAuthConfig writes a plaintext fallback file containing access and refresh tokens under the user's .mcp-atlassian directory using process-default permissions. On systems with a...

DEBIAN-CVE-2026-83602

Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/webapiv3.c with HTTPACLNOCHECK and HTTPACCESSANONYMOUSDATA, causing unauthenticated PUT requests handled by src/web/api/v3/apiv3settings.c to bypass operator-configured allo...

EUVD-2026-84562

Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/webapiv3.c with HTTPACLNOCHECK and HTTPACCESSANONYMOUSDATA, causing unauthenticated PUT requests handled by src/web/api/v3/apiv3settings.c to bypass operator-configured allo...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

Security Bulletin: IBM Guardium Data Protection is affected by a security vulnerability (CVE-2026-49844).

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This...

PT-2026-96925

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description OAuthConfig writes a plaintext fallback file containing access token and refresh token within the user's .mcp-atlassian directory. This file is created using process-default permissions rather...

PT-2026-96953

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The OAuth fallback token directory and JSON files are created without restrictive owner-only permissions, typically resulting in world-readable files mode 0644 on Linux and directories mode...

PT-2026-96709

Name of the Vulnerable Software and Affected Versions ZenHive mpp versions 0.14.0 through 0.16.1 Description Improper validation of the specified quantity in the input allows a client with an open payment channel to obtain paid resources without being charged. The function accept voucher/3 in...

Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: wh...

RockyLinux 8 : grafana (RLSA-2026:54243)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54243 advisory. grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana: Denial of Service due to excessive memory allocation via...

RockyLinux 9 : grafana (RLSA-2026:54184)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:54184 advisory. grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads CVE-2026-42127 Tenable has extracted the preceding description blo...