CVE-2026-12542

A flaw was found in Foreman where the foreman-tail utility is vulnerable to OS command injection . The vulnerability stems from the unsafe use of the eval command, which incorporates unsanitized and unquoted user-supplied arguments into a string to expand file paths. A local attacker can exploit ...

CVE-2026-12542

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not...

Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files

SummaryHTTPSession mounts a FileAdapter for the file:// scheme and inherits redirect handlingunchanged from requests.Session. requests does not check for scheme downgrades orcross-protocol transitions when it follows a redirect, so any https request Streamlink makes canbe redirected by the remote...

PYSEC-2026-4172 Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files

Summary HTTPSession mounts a FileAdapter for the file:// scheme and inherits redirect handling unchanged from requests.Session. requests does not check for scheme downgrades or cross-protocol transitions when it follows a redirect, so any https request Streamlink makes can be redirected by the...

Home Assistant: mDNS Server-Side Request Forgery

SummaryHome Assistant Green is vulnerable to a Server-Side Request Forgery SSRF via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal service...

PYSEC-2026-4051 Home Assistant: mDNS Server-Side Request Forgery

Summary Home Assistant Green is vulnerable to a Server-Side Request Forgery SSRF via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal servic...

PYSEC-2026-4092 MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

Summary The Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server's local filesystem before uploading the file as an Atlassian attachment. In local stdio deployments, this can expose files readable by the user's MCP...

MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)

SummaryThis is an arbitrary local file READ vulnerability on the Confluence and Jira uploadattachment tool paths. It's the symmetric counterpart of the file-write vulnerability you patched as CVE-2026-27825. The write direction was fixed; the read direction was left open.Reporter: Sean...

MCP Atlassian: Insecure File Permissions on OAuth Token Storage

SummaryThe OAuth token fallback file storage in OAuthConfig.savetokenstofile creates token files containing access tokens, refresh tokens, and cloud IDs with default filesystem permissions typically 0644 on Linux, world-readable. Any local user on a shared system can read these files to obtain fu...

PYSEC-2026-4082 MCP Atlassian: Insecure File Permissions on OAuth Token Storage

Summary The OAuth token fallback file storage in OAuthConfig.savetokenstofile creates token files containing access tokens, refresh tokens, and cloud IDs with default filesystem permissions typically 0644 on Linux, world-readable. Any local user on a shared system can read these files to obtain...

PYSEC-2026-4091 MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)

Summary This is an arbitrary local file READ vulnerability on the Confluence and Jira uploadattachment tool paths. It's the symmetric counterpart of the file-write vulnerability you patched as CVE-2026-27825. The write direction was fixed; the read direction was left open. Reporter: Sean Valentin...

MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

SummaryMCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the MC...

MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths

sooperset/mcp-atlassian: HTTP upload tools can attach arbitrary server-local filesDate: 2026-05-05Target: sooperset/mcp-atlassianCommit: d8bc78698a63cb6b321c7ca796d6329d448f7f6d Summarymcp-atlassian supports HTTP/SSE deployment for persistent, remote, and multi-user use. In that mode, write-capab...

PYSEC-2026-4098 MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths

sooperset/mcp-atlassian: HTTP upload tools can attach arbitrary server-local files Date: 2026-05-05 Target: sooperset/mcp-atlassian Commit: d8bc78698a63cb6b321c7ca796d6329d448f7f6d Summary mcp-atlassian supports HTTP/SSE deployment for persistent, remote, and multi-user use. In that mode,...

MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

SummaryIn the documented multi-user HTTP deployment --transport streamable-http with global operator Atlassian credentials, sooperset/mcp-atlassian exposes all tools to unauthenticated network clients, and the uploadattachment tool reads an attacker-supplied filepath with no path validation...

PYSEC-2026-4089 MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

Summary In the documented multi-user HTTP deployment --transport streamable-http with global operator Atlassian credentials, sooperset/mcp-atlassian exposes all tools to unauthenticated network clients, and the uploadattachment tool reads an attacker-supplied filepath with no path validation...

Security Bulletin: Due to Linux, IBM Cloud Pak System is affected by local privilege escalation vulnerability[ CVE-2026-31431]

Summary Vulnerability was found in Linux shipped with IBM Cloud Pak System OS Image for Red hat Linux Systems. Vulnerability was addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-31431 DESCRIPTION: In the Linux kernel, the following vulnerability has been...

tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition

A flaw was found in Apache Tomcat. A Time-of-check Time-of-use TOCTOU race condition exists when creating Unix domain sockets. This vulnerability allows an unauthorized local user to exploit the timing window to gain access to the Unix domain socket. This could lead to information disclosure or...

CVE-2026-13043 WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access

A missing authentication vulnerability in the Kernel Memory Access Driver PSKMAD used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of...

EUVD-2026-90898

A missing authentication vulnerability in the Kernel Memory Access Driver PSKMAD used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of...