122660 matches found
PT-2026-96904
Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description A backslash authority confusion exists in the header-based Jira and Confluence URL authentication flow. The validate url for ssrf function interprets the authority of a URL differently than th...
CVE-2026-75634: Improper Input Validation
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue requires user...
CVE-2026-75633: Improper Input Validation
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user...
CVE-2026-77267: Server-Side Request Forgery (SSRF)
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by processauthenticationheaders and used to construct Atlassian fetchers without calling...
CVE-2026-77265: Server-Side Request Forgery (SSRF)
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for the connection. An unauthenticated caller can use a...
CVE-2026-95813: URL Redirection to Untrusted Site
e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails urlfor in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigation controls to attacker-controlled origins. Attackers can supply host, protocol, and port query...
PT-2026-97054
Name of the Vulnerable Software and Affected Versions e621ng versions prior to 26.09.16 Description Untrusted request parameters are passed directly to the Rails url for function within the PaginatorComponent and controller navigation links. This allows attackers to manipulate pagination and...
PT-2026-96711
Name of the Vulnerable Software and Affected Versions Tauri HTTP plugin affected versions not specified Description The HTTP plugin validates requested URLs against the application's configured scope allowlist only during the initial request. If the remote server returns an HTTP 3xx redirect, the...
PT-2026-96930
Name of the Vulnerable Software and Affected Versions mcp-atlassian versions prior to 0.22.0 Description The UserTokenMiddleware extracts URLs from the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers and passes them to API client constructors without validation. Specifically, the...
PT-2026-96706
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description URLs can be constructed to expand environment variable or INI file values, allowing potentially sensitive information to be exfiltrated to a remote server when a...
PT-2026-96962
Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description An Integer Overflow or Wraparound issue exists, which can lead to an application denial-of-service. An attacker can cause the application to crash by inducing a victim to visi...
RockyLinux 10 : yggdrasil (RLSA-2026:69308)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69308 advisory. mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-42504 encoding/asn1: golang: Go encoding/asn1: Denial of...
RockyLinux 10 : yggdrasil-worker-package-manager (RLSA-2026:69099)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69099 advisory. net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 encoding/xml: golang: Go: Denial of...
PT-2026-96923
Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The software is susceptible to Server-Side Request Forgery SSRF, a condition where an attacker can induce the server to make requests to an unintended location. The validate url for ssrf...
AlmaLinux 10 : yggdrasil (ALSA-2026:69308)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69308 advisory. mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-42504 encoding/asn1: golang: Go encoding/asn1: Denial of Servi...
RHEL 10 : rhc-worker-playbook (RHSA-2026:70103)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:70103 advisory. A worker for yggdrasil that receives Ansible playbooks and executes them against the local host. Security Fixes: encoding/asn1: golang: Go...
CVE-2026-76194: Improper Input Validation
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue requires user...
Important: containernetworking-plugins security update
The Container Network Interface CNI project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated...
Important: runc security update
The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes: net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 For more details about the security issues,...
ALSA-2026:70391 Important: containernetworking-plugins security update
The Container Network Interface CNI project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated...