CVE-2026-77255

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira updateissue attachments argument is converted into local paths and routed to the attachment upload implementation without workspace validation. A caller can make the MCP serv...

CVE-2026-77243 MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, ENABLEDTOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that knows a hidden tool name can directly invoke...

CVE-2026-77267 mcp-atlassian has an incomplete SSRF remediation

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by processauthenticationheaders and used to construct Atlassian fetchers without calling...

CVE-2026-77267 mcp-atlassian has an incomplete SSRF remediation

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by processauthenticationheaders and used to construct Atlassian fetchers without calling...

CVE-2026-77270 MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled filepath values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassia...

PT-2026-96768

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...

PT-2026-97031

Name of the Vulnerable Software and Affected Versions MCMS versions 6.1.1 through 6.2.1 Description A SQL injection issue exists within the custom model/form import feature. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially...

CVE-2026-88416: Undefined Security Weakness

MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...

EUVD-2026-84858

MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...

PT-2026-96754

Name of the Vulnerable Software and Affected Versions NVIDIA NeMo affected versions not specified Description A flaw exists in the dataset-loading workflow where a maliciously crafted model config.yaml file allows the injection of unsafe parameters. This can result in remote code execution, data...

CVE-2026-88416

MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...

CVE-2026-77269: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the remediation for CVE-2026-27825 protects download destinations but does not constrain source paths used by attachment uploads. A caller can provide an absolute or traversal filepat...

CVE-2026-88416

The MCMS software, specifically versions 6.1.1 through 6.2.1 , contains a SQL injection vulnerability within the custom model/form import feature . While the root cause is identified as a flaw in this specific functionality, the provided documents do not specify the exact technical impact or reme...

SUSE CVE-2026-72811

SiYuan versions = v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query kernel/model/backlink.go, which concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement while escaping only the...

Important: Red Hat Security Advisory: Red Hat AI Inference Model Optimization Tools 3.4.5 (cuda)

Red Hat AI Inference Model Optimization Tools 3.4.5 cuda is now available. Red Hat AI Inference Model Optimization Tools...

CVE-2026-94374

MISP is affected by an Insecure Direct Object Reference (IDOR) in the processModuleResultsData method of the Event model. The report processing loop failed to unset the client-supplied id field before calling save() — unlike the adjacent attribute and object loops. Because the EventReport model's...

EUVD-2026-83795

A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function Load of the file gensim/utils.py of the component Model Loader. This manipulation of the argument fname causes deserialization. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-96258

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.3-lts Description An issue exists in the model parameter form route where the system authorizes the workspace path but the ModelSerializer.ModelParams function loads and saves a model using only the id without...

PT-2026-96093

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description An insecure direct object reference exists in the processModuleResultsData function of the Event model. When processing module results, the system fails to unset the client-supplied id field for...

CVE-2026-94091

A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function Load of the file gensim/utils.py of the component Model Loader. This manipulation of the argument fname causes deserialization. It is possible to initiate the attack remotely. The exploit has been...