ROS-20260923-73-0087

The vulnerability of the platformgetresource function in the Linux operating system’s kernel is related to an unvalidated return value. Exploiting this vulnerability could allow an attacker to cause a service failure...

RHEL 10 : perl-DBI (RHSA-2026:70753)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:70753 advisory. The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent...

GHSA-WV8V-V4C5-V75J MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

Summary The mcp-atlassian server exposes an MCP tool confluenceuploadattachment and the Jira attachment variant that accepts an arbitrary server-side file path and opens it for upload without any path validation. When the server is deployed in HTTP transport mode streamable-http or sse, a remote,...

GHSA-8H6X-H86X-75WH SIPGO: DoS via unvalidated WebSocket frame length

Summary The WebSocket transport allocates a buffer from the frame payload length before validating its size, which can lead to an unauthenticated DoS. Details WSConnection.Read allocates a buffer from the declared WebSocket frame length before reading the payload...

CVE-2026-94626

A flaw was found in vLLM. A remote attacker can exploit a vulnerability in the kvtransferparams function on OpenAI-compatible completion endpoints by supplying an unvalidated tpsize parameter. This allows for unbounded memory allocation, leading to memory exhaustion and a kernel Out-Of-Memory OOM...

CVE-2026-77246 MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, an HTTP transport deployment with READONLYMODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including...

CVE-2026-77246

MCP Atlassian , a Model Context Protocol server for Confluence and Jira, is vulnerable to server-local file exfiltration in versions prior to 0.22.0 . In an HTTP transport deployment where READ_ONLY_MODE=false , the server accepts requests without an Authorization identity and allows attacker-con...

CVE-2026-77246 MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, an HTTP transport deployment with READONLYMODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including...

CVE-2026-95659

MISP contains a reflected cross-site scripting XSS vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated...

CVE-2026-95659 MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread

MISP contains a reflected cross-site scripting XSS vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated...

CVE-2026-95659 MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread

MISP contains a reflected cross-site scripting XSS vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated...

RockyLinux 8 : perl-DBI:1.641 (RLSA-2026:69112)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:69112 advisory. perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder CVE-2026-73194 Tenable has extracted the preceding description block directl...

ROS-20260922-73-0126

The vulnerability in golang-x-crypto is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2026-17051 Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length

The Intel SEDI IPM inter-processor mailbox driver in drivers/ipm/ipmsedi.c handles an inbound message interrupt in ipmeventdispose. It read the peer-written doorbell register, extracted the payload length with IPCHEADERGETLENGTH, and passed that length straight to sediipcreadmsg to copy the messa...

Important: Red Hat Security Advisory: perl-DBI:1.641 security update

An update for the perl-DBI:1.641 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

ALSA-2026:69112 Important: perl-DBI:1.641 security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fixes: perl-DBI: DBI for Perl: Heap...

RHEL 8 : perl-DBI:1.641 (RHSA-2026:69112)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:69112 advisory. The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent...

Important: perl-DBI:1.641 security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fixes: perl-DBI: DBI for Perl: Heap...

CVE-2026-16542

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks...

UBUNTU-CVE-2026-69186

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsparse trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because processanswer invokes parsing before transaction ID and...