CVE-2026-48361

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can abuse this flaw to inject malicious scripts into vulnerable form fields . When a victim browses to the page containing the affected field, the malicious JavaScript may be executed in their bro...

CVE-2026-75684

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this by injecting malicious scripts into vulnerable form fields . When a victim navigates to the page containing the compromised field, the malicious JavaScript may execute in their browser. Th...

CVE-2026-75698

Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this flaw by tricking a victim into visiting a maliciously crafted URL or interacting with a compromised web page. Successful exploitation allows the attacker to inject malicious sc...

CVE-2026-75697

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows an attacker to inject malicious scripts into vulnerable form fields . When a victim navigates to a page containing the affected field, the malicious JavaScript may execute in their browser. This co...

CVE-2026-75658

Adobe Bridge is affected by an out-of-bounds write vulnerability (CWE-787) that could allow an attacker to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction , specifically requiring a victim to open a malicious file. No speci...

CVE-2026-75656

Adobe Bridge is affected by an out-of-bounds read vulnerability (CWE-125) that can lead to the disclosure of sensitive memory . An attacker can leverage this flaw to expose sensitive information, though exploitation requires user interaction to open a malicious file. Remediation information is av...

CVE-2026-75649

Adobe Bridge is impacted by a Heap-based Buffer Overflow (CWE-122) vulnerability. This flaw could allow an attacker to achieve arbitrary code execution within the context of the current user. Practical exploitation requires user interaction , specifically when a victim opens a malicious file . Re...

CVE-2026-75676

Adobe Bridge is affected by a Stack-based Buffer Overflow vulnerability (CWE-121). This flaw could allow an attacker to achieve arbitrary code execution within the context of the current user. Exploitation requires user interaction , specifically for a victim to open a malicious file . For remedi...

CVE-2026-75665

Adobe Bridge is impacted by a Heap-based Buffer Overflow (CWE-122) vulnerability. This flaw could allow an attacker to achieve arbitrary code execution within the context of the current user. Successful exploitation requires user interaction , specifically when a victim opens a maliciously crafte...

CVE-2026-75655

Adobe Bridge is affected by an Uncontrolled Recursion vulnerability (CWE-674) that could allow an attacker to achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction , specifically when a victim opens a malicious file. No specific software versi...

CVE-2026-75663

Adobe Bridge is affected by an out-of-bounds write vulnerability (CWE-787). This flaw could allow an attacker to achieve arbitrary code execution within the context of the current user. Successful exploitation requires user interaction , specifically when a victim opens a malicious file. A patch ...

CVE-2026-77246

MCP Atlassian , a Model Context Protocol server for Confluence and Jira, is vulnerable to server-local file exfiltration in versions prior to 0.22.0 . In an HTTP transport deployment where READ_ONLY_MODE=false , the server accepts requests without an Authorization identity and allows attacker-con...

CVE-2026-75632

The CAI Content Credentials software is affected by an Uncontrolled Resource Consumption vulnerability (CWE-400). An attacker can exploit this flaw to exhaust system resources, leading to an application denial-of-service (DoS) condition. The vulnerability is exploitable over the network without r...

CVE-2026-75634

CAI Content Credentials is affected by an Improper Input Validation vulnerability (CWE-20) that could result in a Security feature bypass . An attacker could leverage this flaw to bypass security measures and obtain unauthorized limited write access . Successful exploitation requires user interac...

CVE-2026-19480

The CAI Content Credentials software is affected by an Improper Input Validation vulnerability (CWE-20) that can lead to a Security feature bypass . An attacker could exploit this flaw to bypass security measures and gain unauthorized write access . Notably, exploitation of this issue does not re...

CVE-2026-75633

CAI Content Credentials is impacted by an Improper Input Validation vulnerability (CWE-20). An attacker can exploit this flaw to crash the application, resulting in a denial-of-service (DoS) condition. Successful exploitation requires user interaction , such as a victim visiting a maliciously cra...

CVE-2026-89277

The CAI Content Credentials software is vulnerable to an Integer Overflow or Wraparound (CWE-190) vulnerability. An attacker could exploit this flaw to cause an application crash, resulting in a denial-of-service (DoS) condition. Exploitation requires user interaction, such as a victim visiting a...

CVE-2026-75638

The CAI Content Credentials software is affected by an Improper Input Validation vulnerability (CWE-20). This flaw could allow an attacker to bypass security features and obtain unauthorized write access . Successful exploitation requires user interaction , such as a victim visiting a maliciously...

CVE-2026-76194

The CAI Content Credentials software is affected by an Improper Input Validation vulnerability (CWE-20) that could lead to a Security feature bypass . An attacker could exploit this to gain unauthorized limited write access by tricking a victim into visiting a maliciously crafted URL or interacti...

CVE-2026-77248

Versions of MCP Atlassian prior to 0.22.0 are vulnerable to an unauthenticated arbitrary local file read. The streamable HTTP transport accepts requests without a user identity and defaults to operator credentials, while the upload_attachment function accepts an unrestricted file_path . An unauth...

CVE-2026-95862

Certain UniFi gateway devices are vulnerable to an Out-of-bounds Write vulnerability. A malicious actor with network access could exploit this flaw to perform a Denial of Service (DoS) attack against the device. No specific affected versions, root causes, or remediation steps are provided in the ...

CVE-2026-77256

The MCP Atlassian Model Context Protocol server (versions prior to 0.22.0 ) contains a vulnerability where the plaintext OAuth fallback file, which stores refresh and access tokens , is created with permissions inherited from the process umask . In many standard or permissive configurations, this...

CVE-2026-95861

Certain UniFi gateway devices are vulnerable to an Uncontrolled Recursion vulnerability. A malicious actor with network access can exploit this flaw to perform a Denial of Service (DoS) attack against the device. No specific software versions, root cause files, or remediation steps are provided i...

CVE-2026-77249

MCP Atlassian , an MCP server for Confluence and Jira, is vulnerable to a Server-Side Request Forgery (SSRF) via redirect-based attacks in versions prior to 0.22.0 . The root cause is that the JiraUserMixin._lookup_user_by_permissions function uses the module-level requests.get instead of a prote...

CVE-2026-77259

The MCP Atlassian Model Context Protocol server (for Confluence and Jira) is vulnerable to an arbitrary file read issue prior to version 0.22.0 . The confluence_upload_attachment function fails to verify that a caller-selected server-local file path remains within the intended workspace. This all...

CVE-2026-77268

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to insecure file permissions in versions prior to 0.22.0 . The application creates the OAuth fallback token directory and JSON file without explicit owner-only modes. This allows local users or processes with gr...

CVE-2026-77558

A network-based Out-of-bounds Read vulnerability exists in certain UniFi gateway devices . An attacker with network access can exploit this flaw to perform a Denial of Service (DoS) attack on the affected device. The vulnerability is assigned a High severity score of 7.5. No specific remediation ...

CVE-2026-77556

An Out-of-bounds Read vulnerability exists in certain UniFi gateway devices , which could be exploited by a malicious actor with network access. The vulnerability allows for a Denial of Service (DoS) attack against the device. No specific affected versions, root causes, or remediation details are...

CVE-2026-77555

An Out-of-bounds Write vulnerability exists in certain UniFi gateway devices , potentially accessible to a malicious actor via the network. Exploitation of this vulnerability can lead to a Denial of Service (DoS) attack on the affected device. The documents do not provide specific software versio...

CVE-2026-77544

Certain UniFi gateway devices are susceptible to an Out-of-bounds Write vulnerability. A malicious actor with network access can exploit this flaw to perform a Denial of Service (DoS) attack against the device. The vulnerability carries a CVSS 3.1 base score of 7.5 (High). No specific software ve...

CVE-2026-77247

The MCP Atlassian Model Context Protocol server (versions prior to 0.22.0 ) is vulnerable to an arbitrary server-local file upload on Jira and Confluence. The root cause is the interpretation of caller-controlled path arguments within the file_path and file_paths parameters. Specifically, the too...

CVE-2026-84396

Adobe InDesign Desktop is affected by a NULL Pointer Dereference (CWE-476) vulnerability. An attacker could exploit this issue to cause an application denial-of-service by crashing the software. Successful exploitation requires user interaction , specifically for a victim to open a malicious file...

CVE-2026-76192

Adobe InDesign Desktop is affected by a NULL Pointer Dereference (CWE-476) vulnerability. An attacker could exploit this issue by inducing a victim to open a malicious file , which may result in an application crash leading to a denial-of-service condition. No specific information regarding avail...

CVE-2026-77272

The mcp-atlassian MCP server for Confluence and Jira is vulnerable to Reflected XSS in versions prior to 0.22.0 . The root cause is the lack of input validation in oauth_setup.py, where the oauth error query parameter is passed to CallbackHandler._send_response and interpolated into an HTML page ...

CVE-2026-77269

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to a path traversal flaw in the upload_attachment function prior to version 0.22.0 . While a previous fix for CVE-2026-27825 protected download destinations, it failed to constrain source paths for uploads. An a...

CVE-2026-77266

The MCP Atlassian Model Context Protocol server (versions prior to 0.22.0 ) contains a path traversal vulnerability within the upload_attachment function. The flaw occurs because the application accepts absolute paths and traversal sequences without restricting the resolved path to the server wor...

CVE-2026-77255

The mcp-atlassian Model Context Protocol server (versions prior to 0.22.0 ) is vulnerable to an arbitrary file read and exfiltration via a confused deputy attack. The flaw exists in the update_issue function, where the attachments argument is converted into local paths and passed to the upload_at...

CVE-2026-95831

Perl's Crypt::SelfCertificate versions 1.01 through 1.05 contain embedded malware. The generate_certificate function executes a Python script hidden within a certificate file. This script retrieves and executes code directly from a hardcoded, base64-encoded HTTP URL. This allows for arbitrary cod...

CVE-2026-77262

The MCP Atlassian (sooperset/mcp-atlassian) server is vulnerable to a Path Traversal vulnerability in the confluence_upload_attachment tool prior to version 0.22.0 . The root cause is the lack of path validation on the file_path argument, which is passed directly to the open() function. This allo...

CVE-2026-77254

The mcp-atlassian Model Context Protocol server (versions prior to 0.22.0 ) contains a vulnerability where unauthenticated HTTP MCP requests can bypass per-user identity checks. The flaw allows a network caller to reach tool handlers that utilize globally configured Jira and Confluence credential...

CVE-2026-77253

The MCP Atlassian Model Context Protocol server (versions prior to 0.22.0 ) contains a vulnerability where the Jira and Confluence attachment upload tools accept arbitrary local filesystem paths. An attacker can cross the client-to-server filesystem boundary to disclose sensitive data, such as co...

CVE-2026-77257

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to arbitrary file path traversal in its HTTP-exposed upload tools prior to version 0.22.0 . The root cause is that the server passes a caller-provided file_path to local file operations without restricting acces...

CVE-2026-77261

The MCP Atlassian Model Context Protocol server (versions prior to 0.22.0 ) is vulnerable to Server-Side Request Forgery (SSRF) due to a missing _make_ssrf_safe_hook in the JiraFetcher and ConfluenceFetcher sessions. Specifically, sessions created via the basic-auth and oauth_pat branches can be ...

CVE-2026-77260

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to arbitrary local file read in versions prior to 0.22.0 . The vulnerability exists because the upload_attachment implementations accept an unconstrained file_path , allowing a permitted MCP caller to open and u...

CVE-2026-77271

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to a module overwrite flaw prior to version 0.22.0 . The root cause is that the validate_safe_path function defaults its base directory to os.getcwd(), while certain Confluence attachment call sites omit the bas...

CVE-2026-95660

A security flaw in Moonshot AI Kimi Code (up to version 0.31.0) allows for OS command injection via an unknown function in the MCP Configuration Loader component, specifically within the agent-core-v2/src/agent/mcp/config-loader.ts file. The vulnerability can be triggered remotely through the man...

CVE-2026-77242

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 0.22.0 . The root cause is an incomplete fix for CVE-2026-27826 where the validate_url_for_ssrf function checks resolved addresses, but the underlying R...

CVE-2026-77243

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to an authorization bypass in versions prior to 0.22.0 . The root cause is that while ENABLED_TOOLS and TOOLSETS are applied during tool listing, they are not rechecked when a tools/call request is dispatched. T...

CVE-2026-77251

The MCP Atlassian server, a Model Context Protocol server for Atlassian products, is vulnerable in versions prior to 0.22.0 . The flaw exists because Jira search accepts forbidden project clauses, Confluence search employs an incomplete case-sensitive space check, and Jira board APIs omit project...

CVE-2026-43643

Softaculous Virtualizor versions before 3.2.9 (Patch 9) and 3.0.0 are susceptible to an authorization bypass vulnerability in the billing module handler. An unauthenticated remote attacker can modify any tenant's account balance by sending a POST request to the admin panel dispatcher with crafted...