CVE-2026-77269

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to a path traversal flaw in the upload_attachment function prior to version 0.22.0 . While a previous fix for CVE-2026-27825 protected download destinations, it failed to constrain source paths for uploads. An a...

CVE-2026-77266 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, uploadattachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen...

CVE-2026-77266 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, uploadattachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen...

EUVD-2026-84747

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, uploadattachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen...

CVE-2026-77266 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, uploadattachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen...

CVE-2026-77266

The MCP Atlassian Model Context Protocol server (versions prior to 0.22.0 ) contains a path traversal vulnerability within the upload_attachment function. The flaw occurs because the application accepts absolute paths and traversal sequences without restricting the resolved path to the server wor...

CVE-2021-45010

CVE-2021-45010 エクスプロイトタイトル: Tiny File Manager 2.4.6 認証済み リモートコード実行 日付: 2023年3月4日 エクスプロイト作者: Syd Software リンク: https://github.com/prasathmani/tinyfilemanager バージョン: Tiny File Manager = 2.4.3 テスト環境: Parrot OS 20.04 CVE : CVE-2021-45010 参照:...

CVE-2026-77255 MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira updateissue attachments argument is converted into local paths and routed to the attachment upload implementation without workspace validation. A caller can make the MCP serv...

CVE-2026-77255 MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira updateissue attachments argument is converted into local paths and routed to the attachment upload implementation without workspace validation. A caller can make the MCP serv...

CVE-2026-77255 MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira updateissue attachments argument is converted into local paths and routed to the attachment upload implementation without workspace validation. A caller can make the MCP serv...

CVE-2023-23397

CVE-2023-23397 CVE-2023-23397 C PoC 1- msgkit をダウンロードする 2- appointment クラスを編集し、以下を追加する: 3- プロジェクト内に新しいクラスを作成して、msg ファイルのプロパティを設定する: root@kitploit: using MsgKit.Enums; using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.Threading.Tasks; namespace MsgK...

Malicious code in envparse3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 910a8a8e205bc9a9540696320007c14926950b5a4f832efc577f2fd67ddc80a4 On require'envparse3', the package's main entrypoint invokes a top-level function dispatchAnalytics that reads a bundled image dist/stest.jpg, extrac...

Malicious code in envforge2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9033f3a6856b87cc07c657d93ce184d02db70e8bb67ea2319e634b7531640c11 [email protected] ships a hidden Windows dropper that fires automatically both on require'envforge2' via dist/index.cjs and on invocation of the bundle...

MAL-2026-16392 Malicious code in envforge2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9033f3a6856b87cc07c657d93ce184d02db70e8bb67ea2319e634b7531640c11 [email protected] ships a hidden Windows dropper that fires automatically both on require'envforge2' via dist/index.cjs and on invocation of the bundle...

MAL-2026-16395 Malicious code in envparse3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 910a8a8e205bc9a9540696320007c14926950b5a4f832efc577f2fd67ddc80a4 On require'envparse3', the package's main entrypoint invokes a top-level function dispatchAnalytics that reads a bundled image dist/stest.jpg, extrac...

PlEXcalaison

ローカル特権 PlEXcalasion - CVE-2021-42835 Windows 版 Plex Media Server のバージョン 1.25.0.5282 より前のバージョンは、Time Of Check Time Of Use（TOCTOU）に対して脆弱であり、低特権ユーザーが SYSTEM 権限を取得できる可能性があります。 発見者 Tomer Peled、Netanel Cohen、Amir Shen（BugSec のセキュリティ研究者）によって発見されました。 詳細 Plex for Windows は新しいアップデートをインストールするために...

CVE-2025-6019_Exploit

CVE-2025-6019Exploit ステップ1 Linuxデバイスで1.shを実行し、xfs.imageを構築します。 ステップ2 xfs.imageを被害デバイスに転送し、2.shを実行します。以下のように成功です。 root@kitploit: neko@aosc-neko205 tmp $ bash 2.sh 当前用户: neko uid=1000neko gid=1001neko 组=1001neko,11audio,12video,15cdrom,974ollama,997wheel,999plugdev,1002gamemode 'yes', Mapped file...

CVE-2026-95831 Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated wi...

CVE-2026-95831 Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated wi...

EUVD-2026-84745

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated wi...