CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,477 CVEs published, 360 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,477
Show in the list
Critical, last 7 days
360
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product sooperset:mcp_atlassian. Show all products

33 CVEs, showing 1 to 33
CVESeverityTitlePublished
CVE-2026-27826High 8.2MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).Mar 10, 2026
CVE-2026-73498High 7.7MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachment
Assigned by GitHub_M
Aug 12, 2026
CVE-2026-73496High 7.7MCP Atlassian: Arbitrary server-side file read via attachment upload
Assigned by GitHub_M
Sep 14, 2026
CVE-2026-73497Medium 6.5MCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadata
Assigned by GitHub_M
Sep 14, 2026
CVE-2026-77274High 8.8MCP Atlassian: SSRF Protection Bypass
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77258High 7.7MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77270Medium 6.5MCP Atlassian: Arbitrary File Read via Upload Attachment Tools
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77265Medium 5.9MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77244Critical 10.0[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77250Medium 6.1MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77267High 8.3mcp-atlassian has an incomplete SSRF remediation
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77252Medium 6.5MCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search tools
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77251High 8.3MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77243High 8.8MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77242High 7.5MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77271High 8.3MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77260High 8.3MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77261High 7.1MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77257High 8.3MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77253High 7.1MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77254Critical 9.1MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77262High 8.6MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77255High 8.6MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77266Medium 6.5MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77269Medium 6.5MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77272Medium 5.4MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77247High 8.3MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77268Medium 5.5MCP Atlassian: Insecure File Permissions on OAuth Token Storage
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77259High 7.7MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77249Medium 5.3MCP Atlassian: Incomplete fix for CVE-2026-27826: redirect-based SSRF via unhooked requests session in Jira user-permission lookup
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77256High 8.3MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77248High 8.6MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport
Assigned by GitHub_M
Sep 22, 2026
CVE-2026-77246High 7.4MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path
Assigned by GitHub_M
Sep 22, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.