Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compat…

SUNEDITOR `v2.47.10` appears to allow JavaScript execution through crafted namespaced HTML elements.

The sanitization logic does not fully remove executable event-handler attributes from certain custom/namespaced tags. As a result, an attacker may be able to inject HTML content that exe…

mcp-atlassian deploys in two common patterns:

Pattern A (single-user, server-side credentials): operator sets
JIRA_USERNAME + JIRA_API_TOKEN (or CONFLUENCE_USERNAME + CONFLUENCE_API_TOKEN)
in environment variables. Server uses these to call Jira/Confluence.
This is th…

COSMOS reads configuration from a user-writable overlay (`targets_modified/`) before the read-only plugin-installed `targets/` tree, and the config subsystem executes code on those files: `ConfigParser` renders every file as ERB by default, a `GENERIC_READ_CONVERSION` / `GENERIC_WRITE_C…

The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base6…

SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry

svcauth_gss_decode_credbody() writes the caller's
rpc_gss_wire_cred field by field and assigns gc_ctx.len only on
the success tail. The caller storage is svcda…

On MSWin32 the envelope sender and every recipient go into a single command string, which open() passes to a s…

checkEndPointAuthenticationCredentials() skips th…

### Details

“`python
# lightrag/api/lightrag_server.py:2161
@app.post("/login")
async def login(form_data: OAuth2Passwo…

DBHub `0.21.2` exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example `–transport http –port 8080`.

The HTTP server attempts to protect browser-origin access by checking whether the `Origin` hostname equals the `Host` hostname, …

Type: Improper authorization leading to unauthorized movement of user funds.

The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included MsgMak…

**Payload**
<img width="1529" height="44…

When running in the highly privileged recovery mode, OpenBao was vulnerable to a timing attack against the single recovery token. This allowed an attacker to extract the recovery token and use it to perform operations against the OpenBao instance, including reading or modification of dat…

Verified. Multiple **Unrestricted Path Traversal** vulnerabilities exist in the Knowns MCP `docs` and `memory` tools, allowing arbitrary file read, write, and deletion operations outside the project sandbox. The storage layer functions (`Get`, `Create`, `Update`, `Rename`, `Delete`) in …

The Cline Hub dashboard server (`@cline/cline-hub`), launched via the `cline dashboard` CLI command, accepts WebSocket connections on the `/browser` endpoint without validating the HTTP `Origin` header. When `ROOM_SECRET` is not set—the default for local (`127.0.0.1`) binds—`isAutho…

The KubeEdge NodeUpgradeJob handler constructed the `keadm upgrade edge` command by concatenating the user-controlled `spec.version` and `spec.image` fields into a shell command.

An authenticated user with permission to create or update `NodeUpgradeJob` resources through the v1alpha2 API…

KubeEdge ConfigUpdateJob processing was vulnerable to command injection on edge nodes.

The `updateFields` values from a ConfigUpdateJob were concatenated into a command string and executed through a system shell. An authenticated user with sufficient permissions to create or update …

`ENABLED_TOOLS` and `TOOLSETS` filters are enforced at `tools/list` time only. `tools/call` dispatches from the full unfiltered tool registry (73 tools). Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not secret since mcp-atlass…

The `RECORD_ACTION.PATCH_MULTI` action is not registered in the Valve permission system's `RULES_MAP` (`src/services/permission/valve/rules-map.ts`). When `ConfigPermission.canPerformAction()` is called for a PATCH_MULTI message, `getRulesForMessage()` returns `null` because the action i…

A vulnerability in ZITADEL Actions V1 allows an organization Action author to read files from the ZITADEL host filesystem through the JavaScript `require()` module loader. On common self-hosted deployments this can be chained to steal bootstrap credentials (including the Login Client PA…

**Affected Component**

The issue is in the Goja JavaScript runtime embedded in Nuclei's JavaScript protocol …

`mcp-atlassian` exposes an MCP tool `confluence_upload_attachment` whose `file_path` argument is passed directly to `open(file_path, "rb")` without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exfiltrate them into a …

The wrappers re…

The factory joins the runner arguments, the caller's target, and the
caller's arguments into a single `ProcessS…

– **Actor:** attacker who controls the -o/–output argument to trestle author {catalog,profile,ssp}-generate (e.g. via a CI pipeline that derives the output directory from repository-controlled data)

– **Primitive:** attacker-controlled –output value reaches trestle_root / args.ou…

The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decode_punycode computes the inser…

9router treats local loopback requests as trusted and allows access to `/v1/*` without an
API key. In a documented/common reverse-proxy deployment where nginx forwards public
traffic to the backend via `127.0.0.1`, external non-`Origin` requests are misclassified as
local. This allows un…

A vulnerability in ZITADEL’s Login V2 UI allowed a password-verified browser session to be reused for a new authentication request without re-checking a user’s enrolled second factor (TOTP, OTP, or U2F). An attacker who already knows valid credentials can fully authenticate to an ap…

svcrdma: Fix unmatched rn_unregister on failed accept

When svc_rdma_accept() takes the errout path before
rpcrdma_rn_register() has succeeded, the existing cleanup block
calls rpcrdma_rn_unregister(dev, &newxprt->sc_rn) unconditio…

nfsd: convert nfsd_net boolean flags to unsigned long flags word

nfsd_net contains several boolean fields that are accessed from
concurrent contexts without serialization. In particular,
nfsd4_end_grace() guards its drain path wi…

## GitHub Advisory Details (form fields — paste-ready)

**Affected products**
| Field | Value |
|——-|——-|
…

KubeEdge `keadm` contains a path traversal vulnerability in the `DecompressTarGz` archive extraction function.

Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components, Win…

**Required attacker capability:** Valid username and password for a 2FA-enabled account.

## Summary

`POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, w…

`POST /api/users/onboarding/finish` is registered as **anonymous (unauthenticated)** and creates a user with **full ReadWrite admin permissions**. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, wit…

vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()

vxlan_mdb_is_valid_source(), which validates MDBE_ATTR_SOURCE and every
MDBE_ATTR_SRC_LIST member, accepts the all-zeros address.

A source list is only accepted on a (*…

Summary
——-
The fix for CVE-2026-46439 (3.12.2 / 4.0.3) removed the recursive re-render loop in trestle/core/commands/author/jinja.py render_template, but the custom include tags in trestle/core/jinja/tags.py (MDSectionInclude, MDCleanInclude) still r…

Assessment content at or below version 0.0.261.0 included a check t…

Missing symlin…

btrfs: fix reloc root cleanup in merge_reloc_roots()

If the root we got has zero root refs in its root item, we are resetting
the root's ->reloc_root without using barriers like we do everywhere else.
Sashiko complained about this…

The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated wi…

ACPICA: Add validation for node in acpi_ns_build_normalized_path()

Add validation for node in acpi_ns_build_normalized_path()
to prevent use-after-free vulnerabilities.

PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node

DSP3 has an integrated Ethernet MAC Endpoint which has its own set of
config registers for configuring settings such as ASPM. The Endpoint device
has two p…

The `upload_attachment` method in `confluence/attachments.py` reads and uploads arbitrary local files to Confluence without calling `validate_safe_path()`. Both download methods (`download_attachment` at line 223, `download_content_attachments` at line 272) correctly call `validate_safe_…

Missing path validation in `confluence_upload_attachment` allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, `/proc/self/environ` yields all runtime secrets in a single call.

—
### …

The AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail…

The default Rsdoctor report HTTP server started by `@rsdoctor/rspack-plugin` binds to all network interfaces (`0.0.0.0`) and serves a `POST /api/data/key` endpoint with no authentication and wildcard CORS (`Access-Control-Allow-Origin: *`). Any network-adjacent or remote attacker can se…

An container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So…

`langchain-nvidia-ai-endpoints` versions before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model (VLM) requests. If an application passed attacker-controlled image input to `ChatNVIDIA` or VLM reranking APIs, an attacker could cause files readable by the ap…

Elysia uses `getAll` to retrieve value from FormData. It is called directly relative to the total number of key-value pairs in the form data. The total amount of work the for loop ha…

ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using
unsanitized HTTP query parameter *names* as SQL column identifiers
(e.g. “ `article.${key}` “). TypeORM parameterizes values but not column
names, allowing unauthenticated attackers to inject SQL through crafte…

### Impact

Denial of service via CPU exhaustion when parsing untrusted JSON.

Preconditions:
– …

### Impact

A remote attacker who can submit JSON to any jawn-backed parse method can exhaust JVM heap and trigger `java.lang.OutOfMemoryError`. This is treated by Scala as a fatal error and not typically…

The JLine3 built-in `grep` command wraps the user-supplied regular expression with
`.*` before compiling it with Java's backtracking regex engine. This amplifies
catastrophic backtracking and allows a short pattern such as `(a+)+b` to hang the
command thread on non-matching input. In en…

This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.

Users are…

The affected endpoints relied on client-supplied node information for authentication without providing sufficient authen…

The WebSocket transport allocates a buffer from the frame payload length before validating its size, which can lead to an unauthenticated DoS.

### Details

`WSConnection.Read` allocates a buffer from the declared WebSocket frame length before reading the payload (https://github.com/emi…

The stream parser allocates the SIP body buffer from the `Content-Length` header before validating its size, which can lead to an unauthenticated DoS.

### Details

`ParserStream.parseSingle` allocates the body buffer from the declared `Content-Length` with no size check (https://github…

to_ascii punycode encodes each label and only then applies the 63-byte DNS limit. encode_punycode in both backends follows the sample impleme…

The gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long…

The `vk-app` backend accepted VK application callback data without verifying the callback signature when the `auth_key` parameter was omitted.

Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback field…

Setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to set PostgreSQL `default_transaction_read_only=on` (and open SQLite in `readOnly` mode), but that code is gated on a config value that is never populated, so it neve…

phy: fsl-imx8mq-usb: fix typec switch leak on probe error path

If probe fails after imx95_usb_phy_get_tca() succeeds, the typec
switch leaks because the only cleanup path was in .remove(), which
never runs on probe failure.

Use d…

9router validates image URLs by resolving the host before fetching, but the later
server-side fetch performs a separate DNS resolution. An attacker-controlled DNS name can
resolve to a public IP during validation and then rebind to an internal Docker/private IP
during the fetch. This all…

This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c.

The `mcp-atlassian` server exposes an MCP tool (`confluence_upload_attachment` and the Jira attachment variant) that accepts an arbitrary server-side file path and opens it for upload without any path validation. When the server is deployed in HTTP transport mode (`streamable-http` or `…

9router determines whether an incoming request originates from localhost by trusting the X-9r-Real-Ip HTTP request header. This header is intended to be produced and sanitized exclusively by the bundled custom-server.js layer from the TCP socket address. In deployment modes where request…

gfs2: move quota_init qc iterator increment

Move qc++ from the loop body into the for-loop increment
expression in gfs2_quota_init().

This keeps iterator progression explicit and avoids mixing pointer
advance with duplicate-slot …

Cloudreve v4 splits the storage-quota **check** (reading the user's `used` bytes and comparing them to `MaxStorage`) and the **charge** (incrementing `users.storage`) into two non-atomic steps in the `PrepareUpload` code path. This creates a Time-of-Check to Time-of-Use (TOCTOU) race con…

The Store API v3 endpoint `PATCH /api/v3/store/carts/:id/associate` binds a guest cart to the authenticated caller without verifying possession of that cart. It locates the cart by prefixed ID only — `current_store.carts.where(user: [nil, current_user]).find_by_prefix_id!(params[:id])`…

LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, `_validated_addresses()` in `lightrag/parser/markdown/parser.py`, resolves the image host and rejects it when the resolved IP is not `is_global`. That…

`_make_ssrf_safe_hook()` blocks HTTP redirects to private/internal IPs by validating the `Location` header before the client follows a `3xx` response. The problem is that this hook is only attached in one of three authentication branches — the header-PAT path. Basic auth and OAuth bra…

MCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the…

Hatchet version v0.86.26 and below is vulnerable to OAuth state CSRF (login CSRF / account fixation).

The vulnerable code clears the session `oauth_state_<integration>` value to the empty string `""` after a successful OAuth callback rather than removing the key, and the subsequent st…

Two locations consume an encrypted handle returned by an untrusted external party and use it without verifying that the party is ACL-authorized on it.

#### `VestingWalletConfidential`

Malicious users can call `release` with a malicious token. This token could return an alternative hand…

**Affected:** `@bsv/wallet-toolbox` / `-client` / `-mobile`. Verified in `2.1.21` and `2.1.21-parity-fix.2`; the relevant code is the same at current HEAD

**Summary:**
When `createAction` runs against …

Improper trust boundary enforcement in Lan…

### Description

Klever uses a BDN (Boneh-Drijvers-Neven) BLS multi…

—

## Description

When the node indexe…

The native marketplace enforces an `IsClaimed` guard in `Claim` (`market.go:752`), `CancelOrder` (`market.go:1125`), and `orderEscrowAmount` (`market.go:251`), but **not in `Buy`**.

Marketplace escrow i…

The VM built-in function `KleverUpdateAccountPermission` (registered always-active, `creator.go:381-390` / `core/vmconstants.go:234`) rewrites an account's entire permission set. Its authorization check uses `vmInput.RecipientAddr` **attacker-controlled** instead of the authenticat…

Denial of service via memory exhaustion. Affects all callers who streamed compressed responses relying on the chunk size — explicit (`iter_bytes(chunk_size=…)`) or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a sin…

### ACL Policies

OpenBao supports "templated polices": Policies with placeholders that are replaced at evaluation time.

This allows you to write a single policy which e.g. grants user "alice" access to all entries in a key value engine prefixed with `alice/` while granting "bob" access …

Multiple authorization vulnerabilities in Unleash admin API, including a critical missing `await` that completely bypasses a permission check.

## Vulnerability 1: Missing `await` on Permission Check (HIGH)

**File:** `src/lib/features/segment/segment-controller.ts` (line 345)

`POST /ap…

The Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server's local filesystem before uploading the file as an Atlassian attachment.

In local `stdio` deployments, this can expose files readable by the user's MCP …

– Project: `sooperset/mcp-atlassian`
– Affected function: `validate_url_for_ssrf()`
– Affected path: header-based Jira/Confluence URL authentication flow
– Tested endpoint: `POST /mcp`
– Tested version: `2.14.5`

## Description

The SSRF protection in `validate_url_for_ssrf()` can be…

The path traversal fix introduced in v0.17.0 (GHSA-xjgw-4wvw-rgm4) is incomplete. `validate_safe_path()` is called without an explicit `base_dir`, defaulting to `os.getcwd()`. In standard container deployments the process CWD is the application directory (e.g. `/app`), so paths within t…

The `UserTokenMiddleware` extracts URLs from `X-Atlassian-Jira-Url` and `X-Atlassian-Confluence-Url` HTTP headers and passes them directly to API client constructors without any SSRF validation.

### Affected Package

– **Ecosystem:** PyPI
– **Package:** mcp-atlassian
– **Affected versi…

This is an arbitrary local file READ vulnerability on the Confluence and Jira `upload_attachment` tool paths. It's the symmetric counterpart of the file-write vulnerability you patched as CVE-2026-27825. The write direction was fixed; the read direction was left open.

**Reporter:** Sean…

Date: 2026-05-05
Target: `sooperset/mcp-atlassian`
Commit: `d8bc78698a63cb6b321c7ca796d6329d448f7f6d`

## Summary

`mcp-atlassian` supports HTTP/SSE deployment for persistent, remote, and multi-user use. In that mo…

`mcp-atlassian` is a popular community MCP server wrapper exposing Jira / Confluence to MCP clients. Operators commonly restrict the surface to a small allowlist of projects/spaces via the `JIRA_PROJECTS_FILTER` and `CONFLUENCE_SPACES_FILTER` environment variables, which the README docu…

The `vault_batch` MCP tool (and the equivalent `POST /batch-to-vault` HTTP endpoint) accepted a caller-supplied `vault_dir` path that was passed directly to `path.resolve()` + `fs.mkdir()` with no containment check. A caller — or a prompt-injected LLM driving the MCP — could therefor…

The Vend OAuth2 backend used only the numeric Vend `user_id` as the social-auth UID.

When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one sho…

**Required attacker capability:** Valid login and password for a TOTP-enabled account with desktop sync permission.

## Summary

`POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync…

The handler matches each vhost's locationRules regular expressions against REQUEST_URI, the r…

`HTTPSession` mounts a `FileAdapter` for the `file://` scheme and inherits redirect handling
unchanged from `requests.Session`. `requests` does not check for scheme downgrades or
cross-protocol transitions when it follows a redirect, so any http(s) request Streamlink makes can
be redirec…

### Patches
The problem has been patched in `plone.app.contenttypes`.

* On Plone 6.2, upgrade to `plone.app.…

### Patches
The problem has been patched in `plone.app.dexterity`.

* On Plone 6.2, upgrade to `plon…

When regex search mode is enabled in the JLine3 `nano` editor, the user-supplied
search term is compiled directly as a Java regular expression with no timeout or
backtracking bound. A crafted pattern such as `(a+)+b` can hang the editor session
thread at high CPU, causing a denial of se…

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.…

Cloudreve's server-side request forgery guard `ValidateExternalURL` (`pkg/request/ssrf.go`) resolves a user-supplied URL host and rejects it when any resolved IP is a loopback, private, link-local, multicast, unspecified, CGNAT, or the cloud-metadata address. The classification is perfo…

KubeEdge CloudHub uses the viaduct packer to decode messages received from connected peers. The packer reads a 32-bit payload length from the message header and previously allocated a buffer of that size without enforcing an upper bound.

An authenticated peer that can establish a viaduc…

The upload attachment tools in both Confluence and Jira accept arbitrary file paths without path traversal validation. The upload_attachment methods read any file accessible to the server process and upload it to a Confluence page or Jira issue. Despite the existence of a validate_safe_p…

The `upload_attachment` functions in both the Jira and Confluence modules accept a user-controlled `file_path` parameter and open the specified file for reading **without calling `validate_safe_path()`**. An authenticated MCP client can supply an arbitrary path such as `/etc/passwd` or …

The `confluence_upload_attachment` and `confluence_upload_attachments` MCP tools accept a `file_path` parameter and do not validate that the path is confined to an allowed directory before opening the file. An attacker who can call these tools can read any file accessible to the MCP ser…

OpenCVE contains a Server-Side Request Forgery (SSRF) vulnerability in the notification testing functionality for both Webhook and Slack integrations.

An authenticated user with permission to configure notification channels can trigger test requests to arbitrary HTTP(S) endpoints. Insuf…

When the SDK spawns a sandbox, the `msb sandbox` child process receives the full network configuration as an inline `–network-config <json>` command-line argument, and any per-sandbox environment as repeated `–env KEY=VALUE` arguments. On Linux a process's arguments are world-readable …

## Summary

In the vulnerable version, the sync diff endpoint accepted a user-controlled regex pattern t…

The SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `AuthnRequest`.

Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SA…

The Kiro API-key validation endpoint builds an upstream URL using a user-controlled
`region` value. By supplying a crafted region such as `kiro-canary.local:8443#`, an
authenticated attacker can cause 9router to send the Kiro validation request to an
attacker-controlled host under the c…

1. Primary impact – self-approval: The approver checks (approver-group membership, `change` permission on the object under review, one-response-per-user) are enforced only in the `approve`/`deny` …

A vulnerability was found in Graylog's API endpoint for updating saved searches and dashboards. A user with edit permissions on a dashboard or saved search could grant owner permissions to an arbitrary account, which could then be used to delete the respective saved search or dashboard o…

The `GET /api/v1/stable/durable-tasks/{durable-task}` endpoint (`listDurableEventLog`) is missing tenant authorization validation, allowing any authenticated user to read durable task event logs from any tenant.

### Impact
This CVE requires the attacker to successfully guess the targe…

The whitespace-skip loop right above (lines 55-57) advances `p.i` to `p.srcLen` when the inp…