Security advisories

high2026-09-22

CVE-2026-77248-MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

View chart →

sooperset/mcp-atlassian · GHSA-cc5h-2pwp-pvcc

medium2026-09-22

CVE-2026-76910-Unleash: Clone-feature lets a user copy a feature from a project they cannot read

View chart →

unleash/unleash · GHSA-8xcj-9hfr-fh9j

low2026-09-22

CVE-2026-76909-Unleash: CR-approval email renders user-controlled raw HTML

View chart →

unleash/unleash · GHSA-7hvx-28gp-mf6j

medium2026-09-22

CVE-2026-75510-Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

View chart →

novuhq/novu · GHSA-8gr3-5j6f-25gp

medium2026-09-22

CVE-2026-69190-Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

View chart →

graylog2/graylog2-server · GHSA-m9c2-85gv-8xr5

high2026-09-22

CVE-2026-77322-SIPGO: DoS via unvalidated WebSocket frame length

View chart →

emiago/sipgo · GHSA-8h6x-h86x-75wh

medium2026-09-22

CVE-2026-65829-MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

View chart →

joniles/mpxj · GHSA-7952-gx68-cjqr

high2026-09-22

CVE-2026-61570-MPXJ: XXE Vulnerability in MerlinReader

View chart →

joniles/mpxj · GHSA-5vvx-3h34-f3gj

medium2026-09-22

CVE-2026-62987-Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

View chart →

fabiolb/fabio · GHSA-fq95-v8xc-jm3v

medium2026-09-22

CVE-2026-63628-mppx: Gas Draining with access list

View chart →

wevm/mppx · GHSA-vc9j-9wph-qghj

medium2026-09-22

CVE-2026-63627-mppx: Gas Draining with padding

View chart →

wevm/mppx · GHSA-727h-3vm5-qwq6

medium2026-09-22

CVE-2026-63342-Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

View chart →

hatchet-dev/hatchet · GHSA-g26x-m427-f48f

medium2026-09-22

CVE-2026-61681-Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler

View chart →

hatchet-dev/hatchet · GHSA-fjwv-jf2v-j499

low2026-09-22

CVE-2026-62364-wlc may disclose API tokens to project-configured URLs

View chart →

weblateorg/wlc · GHSA-3mqq-hv9c-85hc

high2026-09-22

CVE-2026-58268-SIPGO: DoS via unvalidated Content-Length in the stream parser

View chart →

emiago/sipgo · GHSA-pg59-5vwg-4jxq

high2026-09-22

CVE-2026-63116-deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

View chart →

deepstreamio/deepstream.io · GHSA-89vx-jh4q-vg3w

high2026-09-22

CVE-2026-62985-request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

View chart →

azu/request-filtering-agent · GHSA-r3r9-wp5j-pq5g

medium2026-09-22

CVE-2026-62866-Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

View chart →

tomwright/dasel · GHSA-65gg-g7rw-6cpc

medium2026-09-22

CVE-2026-59168-Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

View chart →

tomwright/dasel · GHSA-cqxr-jxr2-85pq

medium2026-09-22

CVE-2026-62282-OpenCVE: Server-Side Request Forgery (SSRF) in notifications

View chart →

opencve/opencve · GHSA-ch3g-4xvr-674q