CVE-2026-73496

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the confluenceuploadattachment and confluenceuploadattachments tools pass a client-controlled filepath through src/mcpatlassian/confluence/attachments.py uploadattachment, and the...

CVE-2026-54629

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csvreader and logreader through its MySQL-compatible server port without authentication, authorization, or directory restrictions. A remote attacker can...

CVE-2026-47253

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clearplugincacheplugin SQL scalar function in namespace/otherfunctions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token...

CVE-2026-16335

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vulnerability...

CVE-2026-53713 Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, toabsolutenormalizedpath in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before iscriticalpath evaluates Lua...

EUVD-2026-78070

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, toabsolutenormalizedpath in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before iscriticalpath evaluates Lua...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-24842 DESCRIPTION: node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses...

CVE-2026-47253

Anyquery (an SQL query engine built on SQLite) is vulnerable to path traversal in the clear_plugin_cache(plugin) SQL scalar function (namespace/other_functions.go). Prior to 0.4.5 , the caller-controlled plugin argument is passed through path.Join to os.RemoveAll without rejecting .. segments, al...

EUVD-2026-77807

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clearplugincacheplugin SQL scalar function in namespace/otherfunctions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token...

CVE-2026-47253 Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clearplugincacheplugin SQL scalar function in namespace/otherfunctions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token...

CVE-2026-47253 Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clearplugincacheplugin SQL scalar function in namespace/otherfunctions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token...

CVE-2026-47253 Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clearplugincacheplugin SQL scalar function in namespace/otherfunctions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token...

CVE-2026-16335 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vulnerability...

CVE-2026-16335 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vulnerability...

EUVD-2026-77798

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vulnerability...

CVE-2026-16335

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to read, write, or delete arbitrary files. The CVSS v3.1 score is 8.1 (HIGH) , with low attack complexity, low privileges required, and no scope change; impact ...

CVE-2026-73496 MCP Atlassian: Arbitrary server-side file read via attachment upload

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the confluenceuploadattachment and confluenceuploadattachments tools pass a client-controlled filepath through src/mcpatlassian/confluence/attachments.py uploadattachment, and the...

EUVD-2026-77795

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the confluenceuploadattachment and confluenceuploadattachments tools pass a client-controlled filepath through src/mcpatlassian/confluence/attachments.py uploadattachment, and the...

CVE-2026-73496

MCP Atlassian , a Model Context Protocol server for Confluence and Jira, is vulnerable to arbitrary server-side file read via attachment upload prior to version 0.22.0. The confluence_upload_attachment, confluence_upload_attachments, and jira_update_issue attachment functions pass a client-contro...

rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink

A path traversal and symlink vulnerability in rsync allows a malicious sender with write access to write files outside the intended directory. By exploiting symbolic links in conjunction with the --partial-dir or --backup-dir options, an attacker can bypass path restrictions to modify arbitrary...