EventsSecuring Finance in the Age of AI · Secure.com X ZIG Finance · London, 12 NovRegister now

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

Updated 10 Nov 2026

  1. PublishedSep 22, 2026
    CVE-2026-839647.5 HIGH
    Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    6.2MEDIUM3.1CNACVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  2. PublishedSep 22, 2026
    CVE-2026-772468.6 HIGH
    MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, an HTTP transport deployment with READ_ONLY_MODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including X-Atlassian-Confluence-Url, to select a public attacker hostname or one allowed by MCP_ALLOWED_URL_DOMAINS. A caller can then invoke confluence_upload_attachment or the Jira attachment variant in src/mcp_atlassian/jira/attachments.py with a server-local file_path and cause the MCP process to send the file to the selected attachment endpoint. This issue is fixed in version 0.22.0.
    ScoreSeverityVersionVector String
    8.6HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    7.4HIGH3.1CNACVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
  3. PublishedSep 22, 2026
    CVE-2026-956565.5 MEDIUM
    A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function add_watch_ui_snapshot of the file changedetectionio/blueprint/add_watch_ui/__init__.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.60.1 is able to resolve this issue. The patch is named 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e. The affected component should be upgraded. Was fixed upstream.
    ScoreSeverityVersionVector String
    5.5MEDIUM4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    7.3HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    7.5HIGH2.0CNAAV:N/AC:L/Au:N/C:P/I:P/A:P
  4. PublishedSep 22, 2026
    CVE-2026-772748.8 HIGH
    MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL authentication flow. A crafted URL can validate as an external hostname while the HTTP client connects to an internal host, permitting server-side requests to protected network resources. This issue is fixed in version 0.22.0.
    ScoreSeverityVersionVector String
    8.8HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
    8.2HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
  5. PublishedSep 22, 2026
    CVE-2026-772718.3 HIGH
    MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_safe_path defaults its base directory to os.getcwd(), and affected Confluence attachment call sites omit base_dir, allowing attacker-selected writes within the working directory. This Python module overwrite can provide code execution when the application later imports the modified module, bypassing the remediation tracked as CVE-2026-27825. This issue is fixed in version 0.22.0.
    ScoreSeverityVersionVector String
    8.3HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  6. PublishedSep 22, 2026
    CVE-2026-772657.5 HIGH
    MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for the connection. An unauthenticated caller can use a DNS-rebinding hostname that returns a public address during validation and an internal address during connection, causing requests to internal or metadata services. The advisory traces the vulnerable input and processing flow through X-Atlassian-Jira-Url, X-Atlassian-Confluence-Url, validate_url_for_ssrf, and DNS rebinding, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    5.9MEDIUM3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
  7. PublishedSep 22, 2026
    CVE-2026-772618.5 HIGH
    MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, _make_ssrf_safe_hook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauth_pat branches. If an attacker-controlled or compromised configured Atlassian instance returns a redirect to an internal address, those sessions can follow the redirect without revalidating its destination. This issue is fixed in version 0.22.0.
    ScoreSeverityVersionVector String
    8.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
    7.1HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
  8. PublishedSep 22, 2026
    CVE-2026-772608.3 HIGH
    MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Confluence and Jira upload_attachment implementations accept an unconstrained file_path and open the referenced server-local file. A permitted MCP caller can upload sensitive host files to an Atlassian destination and then retrieve their contents. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and CVE-2026-27825, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
    ScoreSeverityVersionVector String
    8.3HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  9. PublishedSep 22, 2026
    CVE-2026-956549.1 CRITICAL
    Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded invitation link can load the page while pending, then accept the invitation after the legitimate user has already accepted it to overwrite the account password and gain authenticated access to managed database credentials and secrets.
    ScoreSeverityVersionVector String
    9.1CRITICAL4.0CNACVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
    7.4HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
  10. PublishedSep 22, 2026
    CVE-2026-651298.3 HIGH
    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.
    ScoreSeverityVersionVector String
    8.3HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
    6.7MEDIUM3.1CNACVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
  11. PublishedSep 22, 2026
    CVE-2026-651268.8 HIGH
    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    5.0MEDIUM3.1CNACVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
  12. PublishedSep 22, 2026
    CVE-2026-651258.8 HIGH
    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and denial of service.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    6.6MEDIUM3.1CNACVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
  13. PublishedSep 22, 2026
    CVE-2026-651248.1 HIGH
    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of this vulnerability might lead to data tampering and denial of service.
    ScoreSeverityVersionVector String
    8.1HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
    5.9MEDIUM3.1CNACVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
  14. PublishedSep 22, 2026
    CVE-2026-651178.8 HIGH
    NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    5.0MEDIUM3.1CNACVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
  15. PublishedSep 22, 2026
    CVE-2026-252558.8 HIGH
    Exposed dangerous function lead to privilege escalation via gRPC server.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CNACVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  16. PublishedSep 21, 2026
    CVE-2026-945018.7 HIGH
    jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tenant.
    ScoreSeverityVersionVector String
    8.7HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  17. PublishedSep 21, 2026
    CVE-2026-944128.7 HIGH
    jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value, enabling unauthorized access to other user accounts including administrators.
    ScoreSeverityVersionVector String
    8.7HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  18. PublishedSep 19, 2026
    CVE-2026-940567.5 HIGH
    Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
    ScoreSeverityVersionVector String
    7.5HIGH3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  19. PublishedSep 18, 2026
    CVE-2026-880978.1 HIGH
    Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.
    ScoreSeverityVersionVector String
    8.1HIGH3.1CNACVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    7.8HIGH3.1NVDCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
  20. PublishedSep 18, 2026
    CVE-2026-718557.5 HIGH
    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. An IPv6 packet can therefore reuse IPv4 flow state or the reverse, causing incorrect flowbit state, detection bypass, or IP-only bypass. This issue is fixed in versions 8.0.6 and 7.0.17.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    5.9MEDIUM3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
  21. PublishedSep 18, 2026
    CVE-2026-634487.5 HIGH
    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, because cleanup waits for inspection in the unseen direction. The transaction creation paths in rust/src/smb can exceed the intended SMB_MAX_TX bound, and cleanup repeatedly scans the growing list. Sustained one-directional SMB traffic can therefore cause unbounded per-flow state and CPU and memory exhaustion. This issue is fixed in versions 8.0.6 and 7.0.17.
    ScoreSeverityVersionVector String
    7.5HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    5.9MEDIUM3.1CNACVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  22. PublishedSep 18, 2026
    CVE-2026-816268.6 HIGH
    IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the confidentiality, integrity, and availability of the affected system.
    ScoreSeverityVersionVector String
    8.6HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
  23. PublishedSep 18, 2026
    CVE-2026-816238.8 HIGH
    IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileges on the system due to improper validation of user supplied input.
    ScoreSeverityVersionVector String
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    6.3MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
  24. PublishedSep 18, 2026
    CVE-2026-804429.9 CRITICAL
    IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation could allow an attacker to execute unauthorized commands and impact the confidentiality, integrity, and availability of the affected system.
    ScoreSeverityVersionVector String
    9.9CRITICAL3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    8.8HIGH3.1NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  25. PublishedSep 18, 2026
    CVE-2017-202848.7 HIGH
    Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft requests with directory traversal sequences to the servlet endpoint to read files outside the intended tutorial directory on the underlying system. Exploitation evidence was first observed by the Shadowserver Foundation on 2021-12-10.
    ScoreSeverityVersionVector String
    8.7HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    7.5HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Load more

Sources

  • NVD
  • CVE.org
  • CISA KEV
  • FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-10 13:03 UTC.