MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)

Summary GHSA-7r34-79r5-rcc9's fix added validateurlforssrf, which resolves the attacker-controlled X-Atlassian-Jira,Confluence-Url header host once at middleware time and trusts the result. But the outbound request is later built with the raw hostname and re-resolves at connect time with no IP...

CVE-2026-56765

creationtimestamp| type| source ---|---|--- 2026-07-10 16:44:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcltiwe322h 2026-07-12 07:01:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqgm7kzfna2w...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through the image process in open-sse/translator/concerns/image.js. An attacker can access internal-only HTTP services by...

CVE-2026-57224

creationtimestamp| type| source ---|---|--- 2026-07-10 14:00:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqccon2eyw25...

CVE-2026-50178

creationtimestamp| type| source ---|---|--- 2026-07-10 12:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqc5ztca3w25...

CVE-2026-56690

creationtimestamp| type| source ---|---|--- 2026-07-10 12:32:05+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqc5qu5luq2o 2026-07-10 12:53:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqc6wpo2tm2i 2026-07-10 16:49:16+00:00| seen|...

CVE-2026-40454

creationtimestamp| type| source ---|---|--- 2026-07-10 11:11:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbz7ub5sf2f 2026-07-10 12:15:35+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-40454 2026-07-10 13:34:44+00:00| seen|...

CVE-2026-41880

creationtimestamp| type| source ---|---|--- 2026-07-10 11:08:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqbz2mejxm2h 2026-07-10 12:00:35+00:00| seen| https://infosec.exchange/users/offseq/statuses/116895569307199764 2026-07-10 12:00:37+00:00| seen|...

CVE-2026-13010

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-15330

creationtimestamp| type| source ---|---|--- 2026-07-10 09:57:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbv4pxta22y...

CVE-2026-15332

creationtimestamp| type| source ---|---|--- 2026-07-10 09:34:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbttvnaer2a 2026-07-10 22:01:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd5l7hit62w...

CVE-2026-13010

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-42860

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...

Exploit for CVE-2024-51482

CVE-2024-51482 — ZoneMinder Time-Based Blind SQL Injection A...

MAL-2026-10116 Malicious code in jwtmethod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dbd06d83019ce10a1c0da788fc10633f55f9f6c82058ca6841c4650b5611afb On module load, jwtmethod's decode.js executes a top-level routine that performs an HTTPS GET to https://jsonkeeper.com/b/E69V3 and passes the respon...

CVE-2026-21046

Time-of-check time-of-use race condition in fabricKeymaster trustlet prior to SMR Jul-2026 Release 1 allows local privileged attackers to execute arbitrary code...

CVE-2026-15289

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpdevartid’ parameter in all versions up to, and including, 3.2.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

CVE-2026-21046

Time-of-check time-of-use race condition in fabricKeymaster trustlet prior to SMR Jul-2026 Release 1 allows local privileged attackers to execute arbitrary code...

CVE-2026-21046

The vulnerability CVE-2026-21046 concerns the fabricKeymaster trustlet. It describes a time-of-check time-of-use race condition that exists prior to the SMR Jul-2026 Release 1. Impact is local: a privileged attacker could execute arbitrary code. The provided sources specify the affected component...