CVE-2026-92127

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpat...

CVE-2026-92126

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable...

CVE-2026-92125

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox...

CVE-2026-92123

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not intercept operations performed on a null receiver method calls, property and attribute accesses, and array accesses, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the...

CVE-2026-92122

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define an...

CVE-2026-92129

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute...

CVE-2026-88064 Backstage: Improper input validation in TechDocs MkDocs configuration

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

CVE-2026-88064

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

EUVD-2026-80784

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

CVE-2026-88064

Backstage is an open-source framework for building developer portals. The @backstage/plugin-techdocs-node package, prior to 1.14.6 and from 1.15.0 until 1.15.4, insufficiently validates mkdocs.yml files supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python ...

MAL-2026-16234 Malicious code in strapi-plugin-os-rec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b7f08345375bd52a25c34cc61a3e877c1a9f8f364a90a76b3a1eff55216ea03 postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname, os.platform, os.arch, os.type, os.release, the...

Malicious code in strapi-plugin-os-rec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b7f08345375bd52a25c34cc61a3e877c1a9f8f364a90a76b3a1eff55216ea03 postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname, os.platform, os.arch, os.type, os.release, the...

MAL-2026-16228 Malicious code in strapi-plugin-ccrev-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbcdfb404042de180795640d5ea266d8fe50afff5d180b3da0eab17f979369f3 postinstall.js executes automatically on npm install and opens a bash reverse shell via /dev/tcp redirection to the hardcoded remote endpoint...

Malicious code in strapi-plugin-ccrev-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbcdfb404042de180795640d5ea266d8fe50afff5d180b3da0eab17f979369f3 postinstall.js executes automatically on npm install and opens a bash reverse shell via /dev/tcp redirection to the hardcoded remote endpoint...

MAL-2026-16235 Malicious code in strapi-plugin-osag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34d9349a970008e54774fc533af589248d578e1d34f6f82a9a6630beeabd2203 The package presents itself as a Strapi plugin but ships no plugin code — only a postinstall.js script that runs automatically on npm install. The...

Malicious code in strapi-plugin-osag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34d9349a970008e54774fc533af589248d578e1d34f6f82a9a6630beeabd2203 The package presents itself as a Strapi plugin but ships no plugin code — only a postinstall.js script that runs automatically on npm install. The...

MAL-2026-16227 Malicious code in strapi-plugin-ccrec-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27dd1178f43debcd9babc6630aa303b6953e7572d994f8efe3acc75db2cc878e The package's postinstall lifecycle script postinstall.js executes a bash /dev/tcp reverse shell to the hardcoded remote endpoint 14.225.210.85:80,...

Malicious code in strapi-plugin-ccrec-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27dd1178f43debcd9babc6630aa303b6953e7572d994f8efe3acc75db2cc878e The package's postinstall lifecycle script postinstall.js executes a bash /dev/tcp reverse shell to the hardcoded remote endpoint 14.225.210.85:80,...

MAL-2026-16225 Malicious code in strapi-plugin-cccon-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c0ca5cf1881ed03c4a8b91832bcd8f65854bd36d9b764843370d26f599c2a0 postinstall.js runs automatically on npm install and executes a bash reverse shell to the hardcoded remote host 14.225.210.85:80 via /dev/tcp, granti...

Malicious code in strapi-plugin-cccon-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c0ca5cf1881ed03c4a8b91832bcd8f65854bd36d9b764843370d26f599c2a0 postinstall.js runs automatically on npm install and executes a bash reverse shell to the hardcoded remote host 14.225.210.85:80 via /dev/tcp, granti...