122601 matches found
PT-2026-97404
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters...
PT-2026-97497
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The notification template Jinja AST whitelist only inspects static Getattr nodes. This allows dynamic subscripts, such as job'job'+' env', and conditional gating...
AlmaLinux 9 : runc (ALSA-2026:70191)
The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:70191 advisory. net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 Tenable has extracted the preceding description blo...
PT-2026-97523
Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions 5.12.0 through 7.2.9 Description An authenticated actor can execute arbitrary operating system commands as the openc3 service user. The issue occurs when the set setting method at the POST /openc3-api/api endpoint is use...
CVE-2026-96443: Inclusion of Functionality from Untrusted Control Sphere
Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE...
CVE-2026-80444: URL Redirection to Untrusted Site
URL redirection to untrusted site 'open redirect' vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue affects AVESİS: from 202608201331 before 202608240351...
CVE-2026-71463: Generation of Error Message Containing Sensitive Information
Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts job'job'+'env' and % if job.id 100 % conditional gating bypass both the AST check and the test-render stub has small job.id. At runtime, the gated branch executes and exceptions write full tracebacks...
RockyLinux 9 : runc (RLSA-2026:70191)
The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:70191 advisory. net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 Tenable has extracted the preceding description...
AlmaLinux 9 : containernetworking-plugins (ALSA-2026:70391)
The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:70391 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...
Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs. The submodule did not...
Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177
The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary...
Important: skopeo security update
Command line utility to inspect images and repositories directly on Docker registries without the need to pull them. Security Fixes: skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarsha...
ALSA-2026:70641 Important: skopeo security update
Command line utility to inspect images and repositories directly on Docker registries without the need to pull them. Security Fixes: skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarsha...
DEBIAN-CVE-2026-62364
wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...
UBUNTU-CVE-2026-62364
wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...
MCP Atlassian: SSRF Protection Bypass
Environment - Project: sooperset/mcp-atlassian - Affected function: validateurlforssrf - Affected path: header-based Jira/Confluence URL authentication flow - Tested endpoint: POST /mcp - Tested version: 2.14.5 Description The SSRF protection in validateurlforssrf can be bypassed with a URL...
GHSA-HGCF-4MQ8-5266 MCP Atlassian: SSRF Protection Bypass
Environment - Project: sooperset/mcp-atlassian - Affected function: validateurlforssrf - Affected path: header-based Jira/Confluence URL authentication flow - Tested endpoint: POST /mcp - Tested version: 2.14.5 Description The SSRF protection in validateurlforssrf can be bypassed with a URL...
GHSA-5WF4-JQXH-8GM3 mcp-atlassian has an incomplete SSRF remediation
Summary The UserTokenMiddleware extracts URLs from X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers and passes them directly to API client constructors without any SSRF validation. Affected Package - Ecosystem: PyPI - Package: mcp-atlassian - Affected versions: all versions before...
mcp-atlassian has an incomplete SSRF remediation
Summary The UserTokenMiddleware extracts URLs from X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers and passes them directly to API client constructors without any SSRF validation. Affected Package - Ecosystem: PyPI - Package: mcp-atlassian - Affected versions: all versions before...
MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow
Summary The SSRF protection for header-based authentication uses a validate-then-use pattern vulnerable to DNS rebinding. validateurlforssrf resolves the hostname via DNS and checks that the resolved IP is globally routable. However, the actual HTTP request happens later, during which the DNS...