PT-2026-97826

Name of the Vulnerable Software and Affected Versions geelen mcp-remote versions 0.1.18 through 0.1.38 Description A flaw in the SSE Server-Sent Events transport eventSourceInit fetch wrapper located in src/lib/utils.ts allows a remote attacker to obtain sensitive information. Recommendations...

CVE-2026-52001

An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper " src/lib/utils.ts...

RHEL 8 : kernel (RHSA-2026:71592)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71592 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: afalg - Disallow...

USN-8809-1 libgit2 vulnerability

Kazuma Matsumoto and Isabel Mill discovered that libgit2 incorrectly handled certain repository URLs when using the SSH transport. A remote attacker could possibly use this issue to execute arbitrary commands...

USN-8809-1: libgit2 vulnerability

Kazuma Matsumoto and Isabel Mill discovered that libgit2 incorrectly handled certain repository URLs when using the SSH transport. A remote attacker could possibly use this issue to execute arbitrary commands...

Linux Distros Unpatched Vulnerability : CVE-2026-93012

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches...

GHSA-WRHW-J3F9-8VC6 [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

Description mcp-atlassian deploys in two common patterns: Pattern A single-user, server-side credentials: operator sets JIRAUSERNAME + JIRAAPITOKEN or CONFLUENCEUSERNAME + CONFLUENCEAPITOKEN in environment variables. Server uses these to call Jira/Confluence. This is the documented quickstart...

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

Description mcp-atlassian deploys in two common patterns: Pattern A single-user, server-side credentials: operator sets JIRAUSERNAME + JIRAAPITOKEN or CONFLUENCEUSERNAME + CONFLUENCEAPITOKEN in environment variables. Server uses these to call Jira/Confluence. This is the documented quickstart...

MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

Summary ENABLEDTOOLS and TOOLSETS filters are enforced at tools/list time only. tools/call dispatches from the full unfiltered tool registry 73 tools. Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not secret since mcp-atlassian is open...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview mcp-atlassian is a The Model Context Protocol MCP Atlassian integration is an open-source implementation that bridges Atlassian products Jira and Confluence with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with...

GHSA-PG59-5VWG-4JXQ SIPGO: DoS via unvalidated Content-Length in the stream parser

Summary The stream parser allocates the SIP body buffer from the Content-Length header before validating its size, which can lead to an unauthenticated DoS. Details ParserStream.parseSingle allocates the body buffer from the declared Content-Length with no size check...

CVE-2026-58268

The sipgo library (versions prior to 1.4.1 ) is vulnerable to an unauthenticated Denial of Service (DoS) via an oversized Content-Length header. The vulnerability exists in the ParserStream.parseSingle function within sip/parser_stream.go, where the library allocates a SIP body buffer based on th...

CVE-2026-77246 MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, an HTTP transport deployment with READONLYMODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including...

CVE-2026-77246 MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, an HTTP transport deployment with READONLYMODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including...

CVE-2026-77246 MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, an HTTP transport deployment with READONLYMODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including...

EUVD-2026-84771

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, an HTTP transport deployment with READONLYMODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including...

CVE-2026-77244

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globally configured Jira or Confluence credential...

CVE-2026-77244 [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globally configured Jira or Confluence credential...

CVE-2026-77244 [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globally configured Jira or Confluence credential...

CVE-2026-77244 [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globally configured Jira or Confluence credential...