MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths
CVE-2026-77257
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, HT
2026-09-23 归档
今日共收录 1513 条安全情报，包含 580 个 CVE，548 篇安全通告，以及 93 篇研究论文。
← 返回归档列表MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches
CVE-2026-77261
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, _m
MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)
CVE-2026-77260
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)
CVE-2026-77271
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, va
Moonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injection
CVE-2026-95660
A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function o
MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)
CVE-2026-77242
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, va
MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
CVE-2026-77243
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, EN
MCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search tools
CVE-2026-77252
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, ca
mcp-atlassian has an incomplete SSRF remediation
CVE-2026-77267
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th
MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow
CVE-2026-77265
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, he
MCP Atlassian: Arbitrary File Read via Upload Attachment Tools
CVE-2026-77270
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th
dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting
CVE-2026-95657
A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSe
MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()
CVE-2026-77258
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, up
MCP Atlassian: SSRF Protection Bypass
CVE-2026-77274
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, va
Notepad++: Authenticode verification bypass allows modified updater execution
CVE-2026-85995
Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature veri
Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)
CVE-2026-86056
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/
Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)
CVE-2026-77605
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in
Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path
CVE-2026-86054
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in Np
Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog
CVE-2026-85288
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HM
Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value
CVE-2026-85279
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in Pl