CVE-2026-77268

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bi...

CVE-2026-77268

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to insecure file permissions in versions prior to 0.22.0 . The application creates the OAuth fallback token directory and JSON file without explicit owner-only modes. This allows local users or processes with gr...

CVE-2026-77268 MCP Atlassian: Insecure File Permissions on OAuth Token Storage

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bi...

CVE-2026-77250

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, OAuthConfig writes a plaintext fallback file containing access and refresh tokens under the user's .mcp-atlassian directory using process-default permissions. On systems with a...

CVE-2026-77250 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, OAuthConfig writes a plaintext fallback file containing access and refresh tokens under the user's .mcp-atlassian directory using process-default permissions. On systems with a...

CVE-2026-77250

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable in versions prior to 0.22.0 . The OAuthConfig component writes a fallback file containing plaintext access and refresh tokens into the .mcp-atlassian directory using process-default permissions . On systems with...

CVE-2026-54450

ToolHive is a Go utility for deploying and managing Model Context Protocol (MCP) servers. Prior to v0.29.1 , the SSRF guard networking.IsPrivateIP in pkg/networking/utilities.go omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, causing NAT64-encoded private addresses to be classified...

GHSA-H29V-HJ44-Q8CV Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

Summary The /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and refreshtoken as query parameters and issues a 302 redirect to the attacker-supplied URL. An...

CVE-2026-15318 Sipeed PicoClaw MQTT Channel mqtt.go authorization

A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument clientid causes incorrect authorization. The attack is possible to be...

EUVD-2016-3435

Malware in sbrugna...

EUVD-2008-1735

Malware in sbrugna...

EUVD-2022-34305

Malicious code in bioql PyPI...

EUVD-2024-47198

Malicious code in bioql PyPI...

pds_core: remove write-after-free of client_id

...

CVE-2025-6134

Projectworlds Life Insurance Management System 1.0 contains a SQL injection vulnerability in /insertClient.php, caused by manipulation of the client_id parameter. Remote exploitation is possible, and public disclosures exist. Other parameters may be affected. Connected sources note a remediation ...

The vulnerability of the aysavegoogle_credentials() function in the Quiz Maker plugin of the WordPress content management system allows a hacker to gain unauthorized access to protected information and perform cross-site scripting attacks.

The vulnerability of the aysavegooglecredentials function in the Quiz Maker plugin of the WordPress content management system is related to deficiencies in the authentication process when processing the clientid parameter. Exploiting this vulnerability could allow an attacker, operating remotely,...

CVE-2025-37916

CVE-2025-37916 concerns the Linux kernel pds_core component. The issue is a use-after-free caused by a write-after-free of client_id in pdsc_auxbus_dev_del during stress testing, leading to a KFENCE reported bug chain. The fix removes the offending write-after-free by eliminating the client_id cl...

CVE-2025-37916 pds_core: remove write-after-free of client_id

In the Linux kernel, the following vulnerability has been resolved: pdscore: remove write-after-free of clientid A use-after-free error popped up in stress testing: Mon Apr 21 21:21:33 2025 BUG: KFENCE: use-after-free write in pdscauxbusdevdel+0xef/0x160 pdscore Mon Apr 21 21:21:33 2025...

CVE-2024-11302

A missing checkaccess function in the lollmsbindinginfos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and remove bindings arbitrarily. This vulnerability affects the /installbinding and /reinstallbinding endpoints, among others, enabling unauthorized...

CVE-2025-2062

A vulnerability classified as critical has been found in projectworlds Life Insurance Management System 1.0. Affected is an unknown function of the file /clientStatus.php. The manipulation of the argument clientid leads to sql injection. It is possible to launch the attack remotely. The exploit h...