224102 matches found
Missing Authorization
Overview io.jenkins.plugins:mcp-server is a The MCP Model Context Protocol Server Plugin for Jenkins implements the server-side component of the Model Context Protocol. This plugin enables Jenkins to act as an MCP server, providing context, tools, and capabilities to MCP clients, such as...
CVE-2026-57300
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access...
CVE-2026-57280
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection...
CVE-2026-57300
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access...
CVE-2026-57300
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access...
CVE-2026-57300
The Jenkins MCP Server Plugin (version 0.177.v629fdb_2557fe and earlier) contains a missing permission check in the getReplayScripts MCP tool. This vulnerability allows attackers with Item/Read permission to access and read the Pipeline replay scripts of jobs they have access to. To remediate thi...
EUVD-2026-38781
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access...
CVE-2026-57300
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access...
CVE-2026-57280
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection...
CVE-2026-57280
The Jenkins Script Security Plugin version 1402.v94c9ce464861 and earlier contains a vulnerability where it fails to intercept implicit type casts applied to elements of typed for-each loops in sandboxed Groovy scripts. This flaw allows an attacker to provide scripts that can invoke arbitrary con...
CVE-2026-8896
The MIR blocks and shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute and other attributes such as 'readyanimationtext' of the 'mscstats' shortcode in versions up to, and including, 1.0.0. This is due to insufficient input sanitization and outpu...
Cross Site Scripting
Nuxt is vulnerable to cross-site scripting XSS. The vulnerability is due to improper input sanitization in the NoScript component, where untrusted slot content is written to innerHTML without escaping, allowing attackers to inject malicious scripts through user-controlled data that execute in the...
PT-2026-51810
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb 2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access...
CVE-2026-57300: Missing Authorization
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access...
CVE-2026-8905: Cross-Site Request Forgery (CSRF)
The Osiris Signature Banner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious...
Missing permission check in mcp-server allows reading Pipeline replay scripts
mcp-server 0.177.v629fdb2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build. This allows attackers with Item/Read permission to obtain the Pipeline script of jobs. mcp-server 0.178.vffe5ae770f3b requires...
MAL-2026-6354 Malicious code in npm-bug-bounty-test1-rhyselsmore (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 354a2aa5da5356bab1c97537f865ebdf6af3fcc24f74a6f7c6f78181265c8af2 package.json declares a dependency foo whose source URL is https://3223567a82f3.ngrok.app/foo — an ephemeral, anonymous ngrok tunnel with no version...
motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution
Summary The ActionHandler.post method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera actions including snapshots, recording start/stop, and configured action scripts PTZ controls, alarm triggers, etc.. Vulnerability Details File:...
Exploit for Improper Access Control in Widgetfactorylimited Jce
CVE-2025-48907 - Joomla! JCE Unauthenticated RCE Joomla! JCE e...
CVE-2026-50557
CVE-2026-50557 concerns Angular’s template sanitization bypass via namespace handling in @angular/compiler and @angular/core. The issue allows namespaced elements (e.g., svg:script or ) to escape script-element recognition and for security context attribute mappings to bypass runtime/compile-time...