MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow
CVE-2026-77265
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, he
#advisory
共收录 23334 条相关情报。
← 返回所有主题MCP Atlassian: Arbitrary File Read via Upload Attachment Tools
CVE-2026-77270
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th
dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting
CVE-2026-95657
A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSe
MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()
CVE-2026-77258
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, up
MCP Atlassian: SSRF Protection Bypass
CVE-2026-77274
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, va
Notepad++: Authenticode verification bypass allows modified updater execution
CVE-2026-85995
Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature veri
Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)
CVE-2026-86056
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/
Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)
CVE-2026-77605
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in
Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path
CVE-2026-86054
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in Np
Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog
CVE-2026-85288
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HM
Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value
CVE-2026-85279
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in Pl
Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda
CVE-2026-94384
Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:Invoke
Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution
CVE-2026-83597
Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches
Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent
CVE-2026-83600
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART
Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair
CVE-2026-83598
Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powe
Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE
CVE-2026-83603
Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-sta
Netdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write
CVE-2026-83601
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENS
Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK
CVE-2026-83602
Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api
Netdata: WebSocket Decompression Bomb
CVE-2026-83599
Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates per
FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests
CVE-2026-84301
FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios