20931 matches found
CVE-2026-27826
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to version 0.17.0, an unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL b...
GO-2026-4643 WeKnora has DNS Rebinding Vulnerability in web_fetch Tool that Allows SSRF to Internal Resources in github.com/Tencent/WeKnora
WeKnora has DNS Rebinding Vulnerability in webfetch Tool that Allows SSRF to Internal Resources in github.com/Tencent/WeKnora...
GO-2026-4638 WeKnora Vulnerable to Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection in github.com/Tencent/WeKnora
WeKnora Vulnerable to Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection in github.com/Tencent/WeKnora...
GO-2026-4641 WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool in github.com/Tencent/WeKnora
WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool in github.com/Tencent/WeKnora...
CVE-2026-30930
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize method wraps string values in single quotes but does not escape embedded single...
CVE-2026-30928
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file glances.conf via self.config.asdict with no filtering of sensitive values. The configuration file contains credentials for all...
EUVD-2026-10542
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize method wraps string values in single quotes but does not escape embedded single...
Exploit for OS Command Injection in Gl-Inet Gl-Mt300N-V2_Firmware
GL-InjectoR: CVE-2022-31898 Authenticated Command Injection in...
Exploit for Cross-site Scripting in Quantizor Markdown-To-Jsx
███████╗██╗ ██╗ █████╗ ██████╗ ██╗███╗ ██╗ ██████╗ █████...
pentesting-writeups
🔐 Pentesting Writeups Personal penetration testing document...
pentesting-notes
🔐 Pentesting Notes Personal penetration testing documentati...
Exploit for CVE-2026-0709
Hikvision Wireless AP – CVE-2026-0709 Authenticated RCE Tool...
PT-2026-24209
Name of the Vulnerable Software and Affected Versions openclaw-core versions 0.3.x Description A critical deserialization issue exists in openclaw-core that allows arbitrary instruction injection through specially crafted system prompts. This affects all deployed instances. The issue requires...
file type 安全漏洞
File type is a file type detection tool developed by Sindre Sorhus. Versions of File type prior to 21.3.1 had security vulnerabilities. These vulnerabilities stemmed from the ASF file type detection parser, which might enter an infinite loop when processing specially crafted inputs, potentially...
MCP Atlassian 安全漏洞
MCP Atlassian is an MCP server developed by Hyeonsoo Lee, which connects AI assistants with project management tools. There were security vulnerabilities in versions of MCP Atlassian prior to 0.17.0. These vulnerabilities stemmed from the confluencedownloadattachment tool not enforcing directory...
PT-2026-24642
Summary The confluence download attachment MCP tool accepts a download path parameter that is written to without any directory boundary enforcement. An attacker who can call this tool and supply or access a Confluence attachment with malicious content can write arbitrary content to any path the...
Malicious code in json-merge-tool (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f16e8d9c37feb30d5a44f7a94620c3a09d182a34cd5ccc1e7c97aaf4a991ab10 The package json-merge-tool was found to contain malicious code. Source: ghsa-malware 4bb041118bdac1123bd722a9b1f99ddb6ca406f7ce80d5de344b2c36614b89e...
Malicious Package
Overview json-merge-tool is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-1297 Malicious code in json-merge-tool (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f16e8d9c37feb30d5a44f7a94620c3a09d182a34cd5ccc1e7c97aaf4a991ab10 The package json-merge-tool was found to contain malicious code. Source: ghsa-malware 4bb041118bdac1123bd722a9b1f99ddb6ca406f7ce80d5de344b2c36614b89e...