Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

sooperset — Vulnerabilities & Security Advisories 34

Browse all 34 CVE security advisories affecting sooperset. AI-powered Chinese analysis, POCs, and references for each vulnerability.

This page aggregates security vulnerabilities affecting products from the vendor SooperSet. It collects documented security flaws identified in their software releases, covering a historical range of advisories published by the vendor and recognized by major security databases. Readers can utilize this collection to track the vendor's security advisories, understand the prevalence of specific weakness classes within their product line, or look up the detailed vulnerability history of particular SooperSet applications. The data presented here serves as a consolidated reference for security professionals and researchers seeking to assess the risk profile of this vendor. By reviewing the compiled entries, one can identify recurring patterns in software weaknesses, evaluate the frequency of security incidents over time, and monitor how the vendor has historically addressed reported issues. This aggregation supports due diligence processes by providing a comprehensive overview of past security failures without requiring individual searches across multiple disparate sources. The scope includes both publicly disclosed issues and those referenced in official security bulletins, ensuring a broad coverage of known problems. Use this resource to inform security planning, vendor risk assessments, and patch management strategies for environments deploying SooperSet technology. The information is presented in a neutral format to facilitate objective analysis of the vendor's security posture and the technical characteristics of the associated vulnerabilities.

Top products by sooperset: mcp-atlassian
CVE ID Title CVSS Severity Published
CVE-2026-77246 MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path — mcp-atlassian CWE-22 7.4 High 2026-09-22
CVE-2026-77248 MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport — mcp-atlassian CWE-22 8.6 High 2026-09-22
CVE-2026-77256 MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask — mcp-atlassian CWE-732 8.3 High 2026-09-22
CVE-2026-77249 MCP Atlassian: Incomplete fix for CVE-2026-27826: redirect-based SSRF via unhooked requests session in Jira user-permission lookup — mcp-atlassian CWE-918 5.3 Medium 2026-09-22
CVE-2026-77259 MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials — mcp-atlassian CWE-22 7.7 High 2026-09-22
CVE-2026-77268 MCP Atlassian: Insecure File Permissions on OAuth Token Storage — mcp-atlassian CWE-732 5.5 Medium 2026-09-22
CVE-2026-77247 MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters — mcp-atlassian CWE-73 8.3 High 2026-09-22
CVE-2026-77272 MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler — mcp-atlassian CWE-79 5.4 Medium 2026-09-22
CVE-2026-77269 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825) — mcp-atlassian CWE-22 6.5 Medium 2026-09-22
CVE-2026-77266 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call — mcp-atlassian CWE-22 6.5 Medium 2026-09-22
CVE-2026-77255 MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue — mcp-atlassian CWE-22 8.6 High 2026-09-22
CVE-2026-77262 MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825) — mcp-atlassian CWE-22 8.6 High 2026-09-22
CVE-2026-77254 MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials — mcp-atlassian CWE-306 9.1 Critical 2026-09-22
CVE-2026-77253 MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files — mcp-atlassian CWE-22 7.1 High 2026-09-22
CVE-2026-77257 MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths — mcp-atlassian CWE-22 8.3 High 2026-09-22
CVE-2026-77261 MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches — mcp-atlassian CWE-918 7.1 High 2026-09-22
CVE-2026-77260 MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira) — mcp-atlassian CWE-22 8.3 High 2026-09-22
CVE-2026-77271 MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825) — mcp-atlassian CWE-22 8.3 High 2026-09-22
CVE-2026-77242 MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned) — mcp-atlassian CWE-367 7.5 High 2026-09-22
CVE-2026-77243 MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass — mcp-atlassian CWE-862 8.8 High 2026-09-22
CVE-2026-77251 MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud) — mcp-atlassian CWE-1276 8.3 High 2026-09-22
CVE-2026-77252 MCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search tools — mcp-atlassian CWE-284 6.5 Medium 2026-09-22
CVE-2026-77267 mcp-atlassian has an incomplete SSRF remediation — mcp-atlassian CWE-918 8.3 High 2026-09-22
CVE-2026-77250 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions — mcp-atlassian CWE-312 6.1 Medium 2026-09-22
CVE-2026-77244 [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token — mcp-atlassian CWE-287 10.0 Critical 2026-09-22
CVE-2026-77265 MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow — mcp-atlassian CWE-918 5.9 Medium 2026-09-22
CVE-2026-77270 MCP Atlassian: Arbitrary File Read via Upload Attachment Tools — mcp-atlassian CWE-22 6.5 Medium 2026-09-22
CVE-2026-77258 MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path() — mcp-atlassian CWE-22 7.7 High 2026-09-22
CVE-2026-77274 MCP Atlassian: SSRF Protection Bypass — mcp-atlassian CWE-918 8.8 High 2026-09-22
CVE-2026-73497 MCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadata — mcp-atlassian CWE-918 6.5 Medium 2026-09-14

This page lists every published CVE security advisory associated with sooperset. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.