CVE-2026-76194 CAI Content Credentials | Improper Input Validation (CWE-20)

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue requires user...

CVE-2026-77248 MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while uploadattachment accepts an unrestricted filepath. An...

CVE-2026-95862

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...

CVE-2026-77256 MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the plaintext OAuth fallback file containing refresh and access tokens is written with permissions inherited from the process umask. Under common or permissive configurations, other...

CVE-2026-95861

A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...

CVE-2026-77249 MCP Atlassian: Incomplete fix for CVE-2026-27826: redirect-based SSRF via unhooked requests session in Jira user-permission lookup

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, JiraUserMixin.lookupuserbypermissions uses the module-level requests.get function instead of the fetcher's protected session. A caller-controlled public Jira URL can redirect that...

CVE-2026-77259 MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A caller can upload environment files,...

CVE-2026-77268 MCP Atlassian: Insecure File Permissions on OAuth Token Storage

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bi...

CVE-2026-77558

A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...

CVE-2026-77556

A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...

CVE-2026-77555

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...

CVE-2026-77544

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...

CVE-2026-77247 MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. In remote or multi-user...

CVE-2026-84396 InDesign Desktop | NULL Pointer Dereference (CWE-476)

InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in...

CVE-2026-76192 InDesign Desktop | NULL Pointer Dereference (CWE-476)

InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in...

CVE-2026-77272 MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth error query parameter is passed to CallbackHandler.sendresponse in oauthsetup.py and interpolated into an HTML page without escaping. A crafted authorization callback can...

CVE-2026-77269 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the remediation for CVE-2026-27825 protects download destinations but does not constrain source paths used by attachment uploads. A caller can provide an absolute or traversal filepat...

CVE-2026-77266 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, uploadattachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen...

CVE-2026-77255 MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira updateissue attachments argument is converted into local paths and routed to the attachment upload implementation without workspace validation. A caller can make the MCP serv...

CVE-2026-95831 Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated wi...

CVE-2026-77262 MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment accepts an attacker-controlled filepath and does not apply the path restriction added for the earlier download vulnerability. A caller can traverse outside...

CVE-2026-77254 MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network caller c...

CVE-2026-77253 MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the...

CVE-2026-77257 MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller-provided filepath to local file operations without restricting it to the workspace. A remote MCP caller with tool access ca...

CVE-2026-77261 MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, makessrfsafehook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauthpat branches. If an attacker-controlled or compromised configured...

CVE-2026-77260 MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Confluence and Jira uploadattachment implementations accept an unconstrained filepath and open the referenced server-local file. A permitted MCP caller can upload sensitive host...

CVE-2026-77271 MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validatesafepath defaults its base directory to os.getcwd, and affected Confluence attachment call sites omit basedir, allowing attacker-selected writes within the working directory...

CVE-2026-95660 Moonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injection

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched...

CVE-2026-77242 MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validateurlforssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting. A caller can use a short-lived DNS answer that is publi...

CVE-2026-77243 MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, ENABLEDTOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that knows a hidden tool name can directly invoke...

CVE-2026-77251 MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira search accepts a forbidden project clause because it checks only for the presence of project syntax, Confluence search uses an incomplete case-sensitive space check, and Jira boa...

CVE-2026-43643 Softaculous Virtualizor Authorization Bypass via Billing Module Handler

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

CVE-2026-77252 MCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search tools

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, caller-supplied projectsfilter and spacesfilter arguments can replace administrator-configured allowlists, and caller-provided project or space clauses can suppress the configured...

CVE-2026-43642 Softaculous Virtualizor PHP Object Injection via Billing Module Handler

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the...

CVE-2026-77267 mcp-atlassian has an incomplete SSRF remediation

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by processauthenticationheaders and used to construct Atlassian fetchers without calling...

CVE-2026-43641 Softaculous Virtualizor OS Command Injection via Billing Module Handler

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can...

CVE-2026-77250 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, OAuthConfig writes a plaintext fallback file containing access and refresh tokens under the user's .mcp-atlassian directory using process-default permissions. On systems with a...

CVE-2026-18626 Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.

Out-of-bounds Read vulnerability in RTI Connext Professional Core Libraries allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1., from 6.0.0 before 6.0., from 5.3.0 before 5.3., from 5.2.0 before 5.2., from...

CVE-2026-18462 Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation.

Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional Core Libraries allows Shared Resource Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1...

CVE-2026-18461 Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection.

Use of Externally-Controlled Format String vulnerability in RTI Connext Professional Core Libraries allows Format String Injection. This issue affects Connext Professional: from 7.5.0 before 7.7.0.1, from 7.3.0.10 before 7.3.1.6...

CVE-2026-18460 Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.

Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional Core Libraries allows Overflow Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6...

CVE-2026-18459 Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality.

Incorrect Calculation vulnerability in RTI Connext Professional Core Libraries allows Abuse Existing Functionality. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1., from 6.0.0 before 6.0., from 5.3.0 before 5.3., from 5.2.0...

CVE-2026-18457 Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.

Heap-based Buffer Overflow vulnerability in RTI Connext Professional Core Libraries allows Overflow Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1., from 6.0.0 before 6.0., from 5.3.0 before 5.3., from 5.2.3 before 5.2...

CVE-2026-18458 Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.

Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type 'Type Confusion' vulnerability in RTI Connext Professional Core Libraries allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.3.0 before...

CVE-2026-11389 Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.

Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type 'Type Confusion' vulnerability in RTI Connext Professional Core Libraries allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.3.0 before...

CVE-2026-11388 Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation.

Double Free vulnerability in RTI Connext Professional Core Libraries allows File Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.1.0 before 7.3.1.6...

CVE-2026-8849 Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation.

Use After Free vulnerability in RTI Connext Professional Security Plugins allows File Manipulation. This issue affects Connext Professional: from 7.6.0 before 7.7.0.1...

CVE-2026-7866 Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.

Stack-based Buffer Overflow vulnerability in RTI Connext Professional Core Libraries allows Overflow Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1., from 6.0.0 before 6.0., from 5.3.0 before 5.3., from 5.2.0 before...

CVE-2026-77244 [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globally configured Jira or Confluence credential...

CVE-2026-77265 MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for the connection. An unauthenticated caller can use a...