A busier morning than the last few, and this time the dates hold up. The action sits on the agent- and MCP-tooling layer. mcp-atlassian — the Jira/Confluence MCP server plenty of you run — ships 0.22.0 to close three fresh advisories at once: two high-severity file-reads and a DNS-rebinding bypass of the SSRF fix it shipped back in March. Two sharper single items rank above it on CVSS — safeinstall-cli (8.8), a package-install guard for coding agents whose own parsing can wave a raw execution through, and Clauster (8.7), a Claude Code bridge dashboard that serves unauthenticated on any non-loopback bind. All four have a fixed release; all four are an upgrade today.

Worth your morning

mcp-atlassian — three at once, all closed in 0.22.0. The two highs are file-read paths: attachment-upload handlers that resolve a caller-supplied path on the server rather than the client, so a connected client or agent can read files off the host — env-stored credentials, config, other tenants' data in shared deployments (GHSA-g5r6-gv6m-f5jv, GHSA-wm45-qh3g-v83f, both 7.7). The moderate (CVE-2026-27826, 6.5) is an incomplete fix — March's SSRF patch checked the hostname but never pinned the connection to the validated address, so a later re-resolution slips past it. 0.22.0 fixes all three. The file-reads only bite the HTTP/SSE transport, not stdio on your own machine; if you expose the server, upgrade.

Clauster — unauthenticated by default. GHSA-h4g2-xfmw-q2c9 (8.7): the Claude Code bridge dashboard serves its UI and API without auth on any non-loopback bind while auth.enabled is unset, and setting a password doesn't help if the flag stays off. Anyone who can reach it can spawn bridges and run code against your project directories. Fixed in 0.2.2 — upgrade, set auth.enabled: true, and keep it bound to localhost.

safeinstall-cli — the guard with a gap. GHSA-xrmc-c5cg-rv7x (8.8): the tool screens a coding agent's package-manager commands before they run, but its shell parsing can miss a raw package execution and pass it through unchecked. If you lean on it as the safety net for agent-run installs, 0.10.2 closes the gap — until then it's not the backstop you think it is.

BabelDOC rounds out the table but reads as a version check, not news: CVE-2026-54071 (7.8) is a pickle-deserialization RCE in the PDF-translation library's font-map loader, triggered by a crafted PDF. The fix shipped in 0.6.3 on June 3 and only entered GitHub's reviewed feed yesterday. If you run it, 0.6.3 is the floor.

Nothing cleared the bar on the .NET, NuGet, Azure, or Angular side — July's Patch Tuesday lands on the 14th.