High
CVE-2026-77259
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,336
Reset filters
High
CVE-2026-77257
MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths
High
CVE-2026-77262
MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)
Medium
CVE-2026-77270
MCP Atlassian: Arbitrary File Read via Upload Attachment Tools
Medium
CVE-2026-77269
MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)
Medium
CVE-2026-77272
MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler
Medium
CVE-2026-77268
MCP Atlassian: Insecure File Permissions on OAuth Token Storage
High
CVE-2026-77255
MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue
Medium
CVE-2026-77265
MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow
Medium
CVE-2026-62282
OpenCVE: Server-Side Request Forgery (SSRF) in notifications
High
CVE-2026-77246
MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path
Medium
CVE-2026-85999
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)
Critical
CVE-2026-59163
Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
High
CVE-2026-63349
AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
Medium
CVE-2026-64847
AnyIO process-pool workers can block indefinitely on undrained stderr
Medium
CVE-2026-85078
sanic chunked trailer request smuggling allows hidden second request execution
Medium
CVE-2026-69147
vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation
High
CVE-2026-61599
djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
Critical
CVE-2025-59953
LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy
Critical
CVE-2026-61594
djust has an authorization bypass on the WebSocket/SSE mount path
Medium
CVE-2026-87012
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
Critical
CVE-2026-59971
MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
Medium
CVE-2026-87013
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
High
CVE-2026-87011
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.