Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

1166403 matches found

NVD
NVD•added 2026/09/22 7:16 p.m.•16 views

CVE-2026-77254

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network caller c...

9.1CVSS0.0062EPSS
SaveExploits1References4
CVE
CVE•added 2026/09/22 6:49 p.m.•37 views

CVE-2026-77248

Versions of MCP Atlassian prior to 0.22.0 are vulnerable to an unauthenticated arbitrary local file read. The streamable HTTP transport accepts requests without a user identity and defaults to operator credentials, while the upload_attachment function accepts an unrestricted file_path . An unauth...

8.6CVSS5.9AI score0.00413EPSS
SaveExploits0References4Affected Software1
Cvelist
Cvelist•added 2026/09/22 6:49 p.m.•55 views

CVE-2026-77248 MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while uploadattachment accepts an unrestricted filepath. An...

8.6CVSS0.00413EPSS
SaveExploits0References4
Mend
Mend•added 2026/09/22 6:49 p.m.•12 views

CVE-2026-77248

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while uploadattachment accepts an unrestricted filepath. An...

9.2CVSS5.9AI score0.00413EPSS
SaveExploits0References9
EUVD
EUVD•added 2026/09/22 6:49 p.m.•17 views

EUVD-2026-84763

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while uploadattachment accepts an unrestricted filepath. An...

8.6CVSS5.9AI score0.00413EPSS
SaveExploits0References4
osv_cve
osv_cve•added 2026/09/22 6:49 p.m.•24 views

CVE-2026-77248 MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while uploadattachment accepts an unrestricted filepath. An...

8.6CVSS5.9AI score0.00413EPSS
SaveExploits0References6
GithubExploit
GithubExploit•added 2026/09/22 6:40 p.m.•49 views

Exploit for CVE-2026-87902

CVE-2026-87902 — WordPress Core: unauthenticated path traversa...

8.1CVSS8.1AI score0.39979EPSS
SaveExploits32
RedHat Linux
RedHat Linux•added 2026/09/22 6:30 p.m.•27 views

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.16.2 release.

Red Hat Web Terminal Operator 1.16.2 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

7.5CVSS6AI score0.00568EPSS
SaveExploits0References11
RedHat Linux
RedHat Linux•added 2026/09/22 6:30 p.m.•25 views

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.17.1 release.

Red Hat Web Terminal Operator 1.17.1 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

7.5CVSS6AI score0.00568EPSS
SaveExploits0References11
RedHat Linux
RedHat Linux•added 2026/09/22 6:30 p.m.•25 views

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.15.2 release.

Red Hat Web Terminal Operator 1.15.2 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

7.5CVSS6AI score0.00568EPSS
SaveExploits0References11
RedHat Linux
RedHat Linux•added 2026/09/22 6:17 p.m.•26 views

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.14.1 release.

Red Hat Web Terminal Operator 1.14.1 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

7.5CVSS6AI score0.00568EPSS
SaveExploits0References11
NVD
NVD•added 2026/09/22 6:17 p.m.•17 views

CVE-2026-77251

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira search accepts a forbidden project clause because it checks only for the presence of project syntax, Confluence search uses an incomplete case-sensitive space check, and Jira boa...

8.3CVSS0.00242EPSS
SaveExploits1References4
NVD
NVD•added 2026/09/22 6:17 p.m.•27 views

CVE-2026-77244

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globally configured Jira or Confluence credential...

10CVSS0.00286EPSS
SaveExploits1References4
CVE
CVE•added 2026/09/22 6:11 p.m.•41 views

CVE-2026-77254

The mcp-atlassian Model Context Protocol server (versions prior to 0.22.0 ) contains a vulnerability where unauthenticated HTTP MCP requests can bypass per-user identity checks. The flaw allows a network caller to reach tool handlers that utilize globally configured Jira and Confluence credential...

9.1CVSS5.8AI score0.0062EPSS
SaveExploits1References4Affected Software1
osv_cve
osv_cve•added 2026/09/22 6:11 p.m.•20 views

CVE-2026-77254 MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network caller c...

9.1CVSS5.9AI score
SaveExploits0References6
Cvelist
Cvelist•added 2026/09/22 6:11 p.m.•50 views

CVE-2026-77254 MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network caller c...

9.1CVSS0.0062EPSS
SaveExploits1References4
Vulnrichment
Vulnrichment•added 2026/09/22 6:11 p.m.•17 views

CVE-2026-77254 MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network caller c...

9.1CVSS5.8AI score0.0062EPSS
SaveExploits1References4
Mend
Mend•added 2026/09/22 6:11 p.m.•11 views

CVE-2026-77254

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network caller c...

9.3CVSS5.9AI score0.0062EPSS
SaveExploits1References6
EUVD
EUVD•added 2026/09/22 6:11 p.m.•18 views

EUVD-2026-84743

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network caller c...

9.1CVSS5.9AI score0.0062EPSS
SaveExploits1References4
CVE
CVE•added 2026/09/22 5:55 p.m.•39 views

CVE-2026-77251

The MCP Atlassian server, a Model Context Protocol server for Atlassian products, is vulnerable in versions prior to 0.22.0 . The flaw exists because Jira search accepts forbidden project clauses, Confluence search employs an incomplete case-sensitive space check, and Jira board APIs omit project...

8.3CVSS5.9AI score0.00242EPSS
SaveExploits1References4Affected Software1
Rows per page
Query Builder