https://vulnerability.circl.lu/sightings/feed 2026-06-05T21:47:26.022258+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/b87e4258-806c-49dc-bbe3-854fe2891201/export 2026-06-05T21:47:26.410950+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "b87e4258-806c-49dc-bbe3-854fe2891201", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-27825", "type": "published-proof-of-concept", "source": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-xjgw-4wvw-rgm4", "content": "", "creation_timestamp": "2026-02-24T11:57:12.000000Z"} 2026-02-24T11:57:12+00:00 https://vulnerability.circl.lu/sighting/57297c12-61ec-45aa-899b-4b2dc0686b71/export 2026-06-05T21:47:26.410886+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "57297c12-61ec-45aa-899b-4b2dc0686b71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27825", "type": "seen", "source": "https://gist.github.com/alon710/318772c839d4af9a91549fceab76247e", "content": "", "creation_timestamp": "2026-03-10T19:10:06.000000Z"} 2026-03-10T19:10:06+00:00 https://vulnerability.circl.lu/sighting/0ac1f387-a410-4fa1-a61f-42b6d2bbafc6/export 2026-06-05T21:47:26.410808+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "0ac1f387-a410-4fa1-a61f-42b6d2bbafc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27825", "type": "seen", "source": "https://gist.github.com/alon710/466922a78fd1f1a990595c00598870a1", "content": "", "creation_timestamp": "2026-03-10T19:40:06.000000Z"} 2026-03-10T19:40:06+00:00 https://vulnerability.circl.lu/sighting/74ab4f70-2db1-4e8e-98f0-07eec85fd1c3/export 2026-06-05T21:47:26.410741+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "74ab4f70-2db1-4e8e-98f0-07eec85fd1c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27825", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mijhumw7dl27", "content": "", "creation_timestamp": "2026-04-02T15:00:15.189968Z"} 2026-04-02T15:00:15.189968+00:00 https://vulnerability.circl.lu/sighting/8a6de9d2-9e83-4687-95ce-093d07562e10/export 2026-06-05T21:47:26.410669+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "8a6de9d2-9e83-4687-95ce-093d07562e10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27825", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mjoc6cjsrh22", "content": "", "creation_timestamp": "2026-04-17T06:26:47.733286Z"} 2026-04-17T06:26:47.733286+00:00 https://vulnerability.circl.lu/sighting/0ed15bdc-fdd3-4cdc-8183-a846bdf37cc5/export 2026-06-05T21:47:26.410556+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "0ed15bdc-fdd3-4cdc-8183-a846bdf37cc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27825", "type": "seen", "source": "https://t.me/GithubRedTeam/82101", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-27825\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a romain-deperne\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-29 21:58:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPath Traversal in mcp-atlassian via zip extraction in upload_attachment \u2014 CVSS 9.3\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-29T22:00:04.000000Z"} 2026-04-29T22:00:04+00:00 https://vulnerability.circl.lu/sighting/6a6368c0-0494-46bf-af9b-5f3da8f810f7/export 2026-06-05T21:47:26.407282+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "6a6368c0-0494-46bf-af9b-5f3da8f810f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27825", "type": "seen", "source": "https://swecyb.com/ap/users/116080658609901341/statuses/116536100010719335", "content": "(bishopfox.com) SSRF and Token Passthrough in MCP Servers: Old Vulnerabilities in New Integrations\nCritical SSRF-to-RCE chain (CVE-2026-27826) in mcp-atlassian highlights resurgent risks in MCP server integrations. Attackers exploit lax URL validation to access internal systems, cloud metadata, or achieve RCE via path traversal (CVE-2026-27825).\nIn brief - SSRF and token passthrough vulnerabilities in MCP servers (e.g., Atlassian, Microsoft) enable unauthorized access to internal resources, credential exfiltration, and RCE. Mitigations include strict destination validation and network segmentation.\nTechnically - MCP servers accepting arbitrary URIs without validation (e.g., mcp-atlassian\u2019s custom header injection) allow SSRF targeting localhost/cloud metadata (AWS 169.254.169.254). Token passthrough flaws violate OAuth principles, enabling security control bypass. Mitigations: block private IP ranges, enforce allowlists, and adopt RFC 8693 for scoped token exchange.\nSource: https://bishopfox.com/blog/otto-support-ssrf-token-passthrough-with-mcp\n#Cybersecurity #ThreatIntel", "creation_timestamp": "2026-05-08T02:20:59.164474Z"} 2026-05-08T02:20:59.164474+00:00