Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-77259MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentialsPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77268MCP Atlassian: Insecure File Permissions on OAuth Token StoragePyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77247MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parametersPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77272MCP Atlassian: Reflected XSS in OAuth Setup Callback HandlerPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77269MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)PyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77266MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool callPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77255MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issuePyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77262MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)PyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77253MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local filesPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77257MCP Atlassian: HTTP upload tools accept arbitrary server-local file pathsPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77261MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branchesPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77260MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)PyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77271MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)PyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77243MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypassPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77251MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)PyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77267mcp-atlassian has an incomplete SSRF remediationPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77250MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissionsPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77244[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty tokenPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77265MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication FlowPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77270MCP Atlassian: Arbitrary File Read via Upload Attachment ToolsPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77258MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()PyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-77274MCP Atlassian: SSRF Protection BypassPyPI · mcp-atlassian · fixed in 0.22.0
- CVE-2026-86062LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested contentPyPI · lightrag-hku · fixed in 1.5.5
- CVE-2026-85740LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guardPyPI · lightrag-hku · fixed in 1.5.5
- CVE-2026-85734LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force AttacksPyPI · lightrag-hku · fixed in 1.5.5
- CVE-2026-85725LightRAG: Plaintext Passwords Compared Without Constant-Time FunctionPyPI · lightrag-hku · fixed in 1.5.5
- CVE-2026-85709LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error ResponsesPyPI · lightrag-hku · fixed in 1.5.5
- CVE-2026-63374AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofingPyPI · anyio · fixed in 4.14.2
- CVE-2026-94626vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_sizePyPI · vllm · fixed in 0.30.0
- CVE-2026-94625vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer PlaceholdersPyPI · vllm · fixed in 0.30.0