Medium
CVE-2026-77266
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,330
Reset filters
High
CVE-2026-77259
MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials
High
CVE-2026-77261
MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches
High
CVE-2026-77243
MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
High
CVE-2026-77260
MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)
High
CVE-2026-77257
MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths
High
CVE-2026-77262
MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)
Medium
CVE-2026-77270
MCP Atlassian: Arbitrary File Read via Upload Attachment Tools
High
CVE-2026-77251
MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)
Medium
CVE-2026-77269
MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)
Medium
CVE-2026-77272
MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler
Medium
CVE-2026-77268
MCP Atlassian: Insecure File Permissions on OAuth Token Storage
High
CVE-2026-77253
MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files
High
CVE-2026-77255
MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue
Medium
CVE-2026-77265
MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow
Low
CVE-2026-62364
wlc may disclose API tokens to project-configured URLs
High
CVE-2026-59991
psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry
Medium
CVE-2026-62282
OpenCVE: Server-Side Request Forgery (SSRF) in notifications
High
CVE-2026-77248
MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport
High
CVE-2026-77246
MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path
Medium
CVE-2026-86000
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
Medium
CVE-2026-85999
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)
Critical
CVE-2025-66455
LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py
Critical
CVE-2026-59163
Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.