24119 matches found
gitlab_honeypot
This repository does not have a README...
Kintol_Shell_Upload
KintolShellUpload python 2.7...
cve-test-coredns-fork
This repository does not have a README...
cve-2026-0013-exploit
Ce depot n’a pas de fichier README...
vulnerable-java-app
This repository does not have a README...
cve-2020-6864
This repository does not have a README...
CVE-2026-42945
This repository does not have a README...
PYSEC-2026-4081 MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
Summary ENABLEDTOOLS and TOOLSETS filters are enforced at tools/list time only. tools/call dispatches from the full unfiltered tool registry 73 tools. Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not secret since mcp-atlassian is open...
PYSEC-2026-4101 MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files
Summary MCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the M...
PYSEC-2026-4098 MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths
sooperset/mcp-atlassian: HTTP upload tools can attach arbitrary server-local files Date: 2026-05-05 Target: sooperset/mcp-atlassian Commit: d8bc78698a63cb6b321c7ca796d6329d448f7f6d Summary mcp-atlassian supports HTTP/SSE deployment for persistent, remote, and multi-user use. In that mode,...
MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
SummaryENABLEDTOOLS and TOOLSETS filters are enforced at tools/list time only. tools/call dispatches from the full unfiltered tool registry 73 tools. Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not secret since mcp-atlassian is open...
PYSEC-2026-4139 psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry
Summary PSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...
psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry
SummaryPSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...
CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...
CVE-2026-103921
The GraphQL Tools library (prior to version 1.1.35 ) contains a vulnerability where the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection to be disabled for Node.js connections to wss:// endpoints. If an application uses this executor directly or uses url-loa...
CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...
CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...
CVE-2025-56521andCVE-2025-56522
This repository does not have a README...