CVE-2026-77555

An Out-of-bounds Write vulnerability exists in certain UniFi gateway devices , potentially accessible to a malicious actor via the network. Exploitation of this vulnerability can lead to a Denial of Service (DoS) attack on the affected device. The documents do not provide specific software versio...

CVE-2026-77544

Certain UniFi gateway devices are susceptible to an Out-of-bounds Write vulnerability. A malicious actor with network access can exploit this flaw to perform a Denial of Service (DoS) attack against the device. The vulnerability carries a CVSS 3.1 base score of 7.5 (High). No specific software ve...

CVE-2026-77247

The MCP Atlassian Model Context Protocol server (versions prior to 0.22.0 ) is vulnerable to an arbitrary server-local file upload on Jira and Confluence. The root cause is the interpretation of caller-controlled path arguments within the file_path and file_paths parameters. Specifically, the too...

CVE-2026-84396

Adobe InDesign Desktop is affected by a NULL Pointer Dereference (CWE-476) vulnerability. An attacker could exploit this issue to cause an application denial-of-service by crashing the software. Successful exploitation requires user interaction , specifically for a victim to open a malicious file...

CVE-2026-76192

Adobe InDesign Desktop is affected by a NULL Pointer Dereference (CWE-476) vulnerability. An attacker could exploit this issue by inducing a victim to open a malicious file , which may result in an application crash leading to a denial-of-service condition. No specific information regarding avail...

CVE-2026-77272

The mcp-atlassian MCP server for Confluence and Jira is vulnerable to Reflected XSS in versions prior to 0.22.0 . The root cause is the lack of input validation in oauth_setup.py, where the oauth error query parameter is passed to CallbackHandler._send_response and interpolated into an HTML page ...

CVE-2026-77269

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to a path traversal flaw in the upload_attachment function prior to version 0.22.0 . While a previous fix for CVE-2026-27825 protected download destinations, it failed to constrain source paths for uploads. An a...

CVE-2026-77266

The MCP Atlassian Model Context Protocol server (versions prior to 0.22.0 ) contains a path traversal vulnerability within the upload_attachment function. The flaw occurs because the application accepts absolute paths and traversal sequences without restricting the resolved path to the server wor...

CVE-2026-77255

The mcp-atlassian Model Context Protocol server (versions prior to 0.22.0 ) is vulnerable to an arbitrary file read and exfiltration via a confused deputy attack. The flaw exists in the update_issue function, where the attachments argument is converted into local paths and passed to the upload_at...

CVE-2026-95831

Perl's Crypt::SelfCertificate versions 1.01 through 1.05 contain embedded malware. The generate_certificate function executes a Python script hidden within a certificate file. This script retrieves and executes code directly from a hardcoded, base64-encoded HTTP URL. This allows for arbitrary cod...

CVE-2026-77262

The MCP Atlassian (sooperset/mcp-atlassian) server is vulnerable to a Path Traversal vulnerability in the confluence_upload_attachment tool prior to version 0.22.0 . The root cause is the lack of path validation on the file_path argument, which is passed directly to the open() function. This allo...

CVE-2026-77254

The mcp-atlassian Model Context Protocol server (versions prior to 0.22.0 ) contains a vulnerability where unauthenticated HTTP MCP requests can bypass per-user identity checks. The flaw allows a network caller to reach tool handlers that utilize globally configured Jira and Confluence credential...

CVE-2026-77253

The MCP Atlassian Model Context Protocol server (versions prior to 0.22.0 ) contains a vulnerability where the Jira and Confluence attachment upload tools accept arbitrary local filesystem paths. An attacker can cross the client-to-server filesystem boundary to disclose sensitive data, such as co...

CVE-2026-77257

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to arbitrary file path traversal in its HTTP-exposed upload tools prior to version 0.22.0 . The root cause is that the server passes a caller-provided file_path to local file operations without restricting acces...

CVE-2026-77261

The MCP Atlassian Model Context Protocol server (versions prior to 0.22.0 ) is vulnerable to Server-Side Request Forgery (SSRF) due to a missing _make_ssrf_safe_hook in the JiraFetcher and ConfluenceFetcher sessions. Specifically, sessions created via the basic-auth and oauth_pat branches can be ...

CVE-2026-77260

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to arbitrary local file read in versions prior to 0.22.0 . The vulnerability exists because the upload_attachment implementations accept an unconstrained file_path , allowing a permitted MCP caller to open and u...

CVE-2026-77271

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to a module overwrite flaw prior to version 0.22.0 . The root cause is that the validate_safe_path function defaults its base directory to os.getcwd(), while certain Confluence attachment call sites omit the bas...

CVE-2026-95660

A security flaw in Moonshot AI Kimi Code (up to version 0.31.0) allows for OS command injection via an unknown function in the MCP Configuration Loader component, specifically within the agent-core-v2/src/agent/mcp/config-loader.ts file. The vulnerability can be triggered remotely through the man...

CVE-2026-77242

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 0.22.0 . The root cause is an incomplete fix for CVE-2026-27826 where the validate_url_for_ssrf function checks resolved addresses, but the underlying R...

CVE-2026-77243

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to an authorization bypass in versions prior to 0.22.0 . The root cause is that while ENABLED_TOOLS and TOOLSETS are applied during tool listing, they are not rechecked when a tools/call request is dispatched. T...

CVE-2026-77251

The MCP Atlassian server, a Model Context Protocol server for Atlassian products, is vulnerable in versions prior to 0.22.0 . The flaw exists because Jira search accepts forbidden project clauses, Confluence search employs an incomplete case-sensitive space check, and Jira board APIs omit project...

CVE-2026-43643

Softaculous Virtualizor versions before 3.2.9 (Patch 9) and 3.0.0 are susceptible to an authorization bypass vulnerability in the billing module handler. An unauthenticated remote attacker can modify any tenant's account balance by sending a POST request to the admin panel dispatcher with crafted...

CVE-2026-77252

The MCP Atlassian Model Context Protocol server is vulnerable in versions prior to 0.22.0 due to an authentication bypass in how it handles project and space filters. Specifically, caller-supplied projects_filter and spaces_filter arguments can replace administrator-configured allowlists , while ...

CVE-2026-43642

Softaculous Virtualizor versions before 3.2.9 (Patch 9) and 3.0.0 are vulnerable to a PHP object injection flaw in the billing module handler. An unauthenticated remote attacker can achieve remote code execution as root by supplying arbitrary serialized PHP objects via the billing_data POST field...

CVE-2026-77267

The MCP Atlassian server (a Model Context Protocol server for Confluence and Jira) is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 0.22.0 . The root cause is that the _process_authentication_headers function processes X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url he...

CVE-2026-43641

Softaculous Virtualizor versions before 3.2.9 (Patch 9) and 3.0.0 are vulnerable to an OS command injection in the billing module handler. Unauthenticated remote attackers can bypass authentication using specific parameter combinations to deserialize a crafted billing_data POST field. The uid fie...

CVE-2026-77250

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable in versions prior to 0.22.0 . The OAuthConfig component writes a fallback file containing plaintext access and refresh tokens into the .mcp-atlassian directory using process-default permissions . On systems with...

CVE-2026-18626

The RTI Connext Professional (Core Libraries) component is vulnerable to an Out-of-bounds Read vulnerability, which allows for Overread Buffers . This issue impacts multiple versions, including versions 7.4.0 before 7.7.0.1 , 7.0.0 before 7.3.1.6 , and various versions in the 6.x , 5.x , and 5.0....

CVE-2026-18462

The RTI Connext Professional (Core Libraries) software is vulnerable to an Integer Overflow or Wraparound and Improper Access Control vulnerability. This flaw allows for Shared Resource Manipulation and affects specific versions: 7.4.0 before 7.7.0.1 , 7.0.0 before 7.3.1.6 , and *6.1.0 before 6.1...

CVE-2026-18461

The RTI Connext Professional (Core Libraries) is vulnerable to a Format String Injection flaw due to the Use of Externally-Controlled Format String . This vulnerability affects versions 7.5.0 before 7.7.0.1 and 7.3.0.10 before 7.3.1.6 . An attacker could potentially exploit this to impact the con...

CVE-2026-18460

An off-by-one error leading to an out-of-bounds write vulnerability exists in the RTI Connext Professional (Core Libraries) . This flaw allows for overflow buffers and affects versions 7.4.0 before 7.7.0.1 and 7.0.0 before 7.3.1.6 . No specific exploitation details or remediation steps are provid...

CVE-2026-18459

An Incorrect Calculation vulnerability exists in RTI Connext Professional (Core Libraries) , allowing for the Abuse of Existing Functionality . This issue impacts several versions, including 7.4.0 before 7.7.0.1 , 7.0.0 before 7.3.1.6 , 6.1.0 before 6.1. , 6.0.0 before 6.0. , 5.3.0 before 5.3. , ...

CVE-2026-18457

A heap-based buffer overflow vulnerability exists in the RTI Connext Professional (Core Libraries) . This flaw allows for overflow buffers and impacts multiple versions, including 7.4.0 before 7.7.0.1 , 7.0.0 before 7.3.1.6 , 6.1.0 before 6.1. , 6.0.0 before 6.0. , 5.3.0 before 5.3. , and 5.2.3 b...

CVE-2026-18458

The RTI Connext Professional (Core Libraries) software contains an Out-of-bounds Read , Function Call With Incorrect Number of Arguments , and Access of Resource Using Incompatible Type (Type Confusion) vulnerability. This flaw allows for Overread Buffers and affects Connext Professional versions...

CVE-2026-11389

A Type Confusion vulnerability exists in RTI Connext Professional (Core Libraries) , leading to an Out-of-bounds Read , a Function Call With Incorrect Number of Arguments , and Access of Resource Using Incompatible Type . This flaw allows for Overread Buffers . The affected versions are 7.4.0 bef...

CVE-2026-11388

A Double Free vulnerability exists in the RTI Connext Professional (Core Libraries) , affecting versions 7.4.0 before 7.7.0.1 and 7.1.0 before 7.3.1.6 . This flaw allows for File Manipulation . The vulnerability is rated as MEDIUM severity with a CVSS 4.0 score of 6.9 , requiring LOCAL access and...

CVE-2026-8849

A Use After Free vulnerability exists in RTI Connext Professional (Security Plugins) affecting versions from 7.6.0 before 7.7.0.1 . This flaw allows for File Manipulation on the target system. The vulnerability has a High base severity score of 7.7 .

CVE-2026-7866

A stack-based buffer overflow vulnerability exists in RTI Connext Professional (Core Libraries) . This issue affects several versions, including 7.4.0 before 7.7.0.1 , 7.0.0 before 7.3.1.6 , and various older versions ranging from 4.3x to 6.1.0 . The vulnerability allows for overflow buffers , po...

CVE-2026-77244

The MCP Atlassian server (Model Context Protocol for Atlassian products) is vulnerable prior to version 0.22.0 due to a flaw in the HTTP transport . The system accepts requests without verifying user identity, causing the downstream fetcher to fall back to the operator's globally configured Jira ...

CVE-2026-77265

The mcp-atlassian Model Context Protocol server is vulnerable to Server-Side Request Forgery (SSRF) via DNS rebinding in versions prior to 0.22.0 . The flaw exists in the header-based authentication flow where the software uses a validate-then-use pattern. Specifically, the validate_url_for_ssrf ...

CVE-2026-77270

The MCP Atlassian server (a Model Context Protocol server for Jira and Confluence) is vulnerable in versions prior to 0.22.0 . The jira_upload_attachment and confluence_upload_attachment tools fail to validate file_path values, treating caller-controlled inputs as trusted server-local paths. An a...

CVE-2026-95657

The dgtlmoon Changedetection.io application is vulnerable to cross-site scripting (XSS) in versions up to 0.55.8 . The flaw exists in the setCurrentSelectedText function of the changedetectionio/static/js/visual-selector.js file within the Visual Selector component. A remote attacker can trigger ...

CVE-2026-75703

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code (Code Injection) vulnerability. This flaw allows an attacker to execute arbitrary code in the context of the current user without requiring any user interaction. While the initial description mentions arbitrary ...

CVE-2026-84412

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code (Code Injection) vulnerability (CWE-94 ). This flaw allows an attacker to execute arbitrary code in the context of the current user without requiring any user interaction. The vulnerability is categorized as cri...

CVE-2026-89276

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code (Code Injection) vulnerability. A low-privileged attacker can exploit this flaw to achieve arbitrary code execution in the context of the current user without any user interaction. To remediate this issue, Adobe...

CVE-2026-83660

Adobe Campaign Classic (ACC) is impacted by a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) that can lead to privilege escalation . The vulnerability can be exploited without any user interaction. To mitigate this risk, Adobe recommends updating to version 7.4.4 build 9402 . Adobe-ho...

CVE-2026-82013

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) that can lead to privilege escalation . A low-privileged attacker can exploit this flaw to gain elevated access to internal resources without any user interaction. To mitigate this vulnerabili...

CVE-2026-82003

Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnerability (CWE-20) that could lead to arbitrary code execution within the context of the current user. A low-privileged attacker can exploit this flaw, although the exploit depends on conditions beyond the attacker's con...

CVE-2026-82009

Adobe Campaign Classic (ACC) is vulnerable to an SQL Injection vulnerability (CWE-89) caused by improper neutralization of special elements in SQL commands. An attacker with high privileges can exploit this issue without user interaction to execute arbitrary SQL commands, potentially leading to a...

CVE-2026-75721

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code (Code Injection) vulnerability, which may lead to arbitrary code execution in the context of the current user. This vulnerability can be exploited remotely without any user interaction and without authentication...