Security advisories

medium2026-09-22

CVE-2026-76802-Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass

View chart →

projectdiscovery/nuclei · GHSA-jpf4-98qj-qr67

high2026-09-22

CVE-2026-76819-Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability

View chart →

projectdiscovery/nuclei · GHSA-vxg7-f2jj-jmqm

medium2026-09-22

CVE-2026-77561-Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

View chart →

tinyauthapp/tinyauth · GHSA-9xhm-w3wj-xhqh

high2026-09-22

CVE-2026-77560-Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

View chart →

tinyauthapp/tinyauth · GHSA-328g-jx67-v94g

medium2026-09-22

CVE-2026-77582-Tinyauth: User enumeration attack by timing oracle

View chart →

tinyauthapp/tinyauth · GHSA-456h-ww26-f758

high2026-09-22

CVE-2026-62371-KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API

View chart →

kubeedge/kubeedge · GHSA-5jpj-293f-rhvj

medium2026-09-22

CVE-2026-62370-KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub

View chart →

kubeedge/kubeedge · GHSA-gfw4-49f9-cp25

high2026-09-22

CVE-2026-62369-KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

View chart →

kubeedge/kubeedge · GHSA-9vm9-pqxx-x83v

medium2026-09-22

CVE-2026-63131-OpenBao Skips Stricter Deny Policy for LIST operations

View chart →

openbao/openbao · GHSA-xp3c-3jw3-4vcr

critical2026-09-22

CVE-2026-63132-OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

View chart →

openbao/openbao · GHSA-34fc-gh42-pj53

high2026-09-22

CVE-2026-71543- OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

View chart →

openbao/openbao · GHSA-59w7-v8rr-pr4p

low2026-09-22

CVE-2026-77285-OpenBao Agent Writes Secrets to Stdout

View chart →

openbao/openbao · GHSA-444v-8vxr-p36h

high2026-09-22

CVE-2026-62182-KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes

View chart →

kubeedge/kubeedge · GHSA-m3c6-2p7h-cfr3

high2026-09-22

CVE-2026-77426-Unleash: Missing await on permission check + cross-project IDOR in admin API

View chart →

unleash/unleash · GHSA-72h8-wp98-7hch

medium2026-09-22

CVE-2026-77425-Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

View chart →

unleash/unleash · GHSA-5ffh-6f9q-5hhr

high2026-09-22

CVE-2026-77258-MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()

View chart →

sooperset/mcp-atlassian · GHSA-93xw-j965-9mx3

medium2026-09-22

CVE-2026-77250-MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

View chart →

sooperset/mcp-atlassian · GHSA-g5xv-mhgm-v5f6

medium2026-09-22

CVE-2026-77249-MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup

View chart →

sooperset/mcp-atlassian · GHSA-v9m3-wfh8-5646

high2026-09-22

CVE-2026-77247-MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

View chart →

sooperset/mcp-atlassian · GHSA-f6pj-qv47-g96w

critical2026-09-22

CVE-2026-77244-[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

View chart →

sooperset/mcp-atlassian · GHSA-wrhw-j3f9-8vc6