CVE-2026-92122: Protection Mechanism Failure

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define an...

CVE-2026-92125: Improper Control of Generation of Code

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox...

CVE-2026-73166: Improper Control of Generation of Code

Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary code on the device, including OS...

CVE-2026-63325: Improper Control of Generation of Code

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

PT-2026-99416

A vulnerability was discovered in libgd2, a library for programmatic graphics creation and manipulation, which may result in denial of service or potentially the execution of arbitrary code if a malformed GIF file is processed...

Oracle Linux 8 : ELSA-2026-67278-0: / perl:5.32 (ELSA-2026-672780)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-672780 advisory. - Fixes: CVE-2026-13221 - Don't create a trie that would overflow - Fix CVE-2025-40909 - Clone dirhandles without fchdir - Fix CVE-2023-47038 - Fix...

SUSE SLED15 / SLES15 Security Update : python-GitPython (SUSE-SU-2026:4191-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4191-1 advisory. - CVE-2026-87817: failure to properly validade the git directory location allows attackers to impersonate the...

PT-2026-93866

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description An issue in the web-based management interface allows an authenticated remote attacker with at least low-privileged administrative credentials to execute arbitrary commands on the underlyin...

PT-2026-93771

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description The plugin downloads a JAR file from a specified URL twice. It confirms the approval of the first download but loads the classpath entries from the second. This...

PT-2026-93864

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description An issue in the diagnostic tools allows an authenticated remote attacker with administrative credentials to perform command injection on the...

PT-2026-93770

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description An issue exists where classpath entries in an item configuration are automatically approved when a user with Overall/Administer permission copies the item or...

PT-2026-94124

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description djust allows an unauthenticated WebSocket or SSE client to trigger the import and execution of the top-level code of any importable Python module. This occurs because the live transport resolves the...

PT-2026-93911

Name of the Vulnerable Software and Affected Versions @redocly/respect-core versions prior to 2.33.0 @redocly/cli versions prior to 2.33.0 Description The respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

PT-2026-93766

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description Attackers with permission to define and run sandboxed scripts, including Pipelines, can bypass sandbox protection to execute arbitrary code in the context of th...

CVE-2026-92127: Improper Control of Generation of Code

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpat...

PT-2026-93916

An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a local attcker to execute arbitrary code via the BOOTia32.efi and a crafted cloak32.dat file on the ESP...

PT-2026-93765

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1415.v9a f9b 3a c253d and earlier Description An issue exists where the plugin fails to verify the method called through a proxy created when a sandboxed script coerces a value to an interface. If the...

CVE-2026-92124: Protection Mechanism Failure

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast on the collection itself, allowing attackers with permission to define and run...

EUVD-2026-80932

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

D-Link DI-8100 router CGI Endpoint Heap Buffer Overflow DoS

The vulnerability of the tgfilehtm function in the CGI Endpoint of the D-Link DI-8100 router’s microprogramming system is related to the issue of writing operations outside of the buffer in memory when processing the fn parameter. Exploiting this vulnerability allows an attacker to execute...