installer v14.0.0-rc.7

Overview Installation mql cnspec Scan your target platform Package Information Kubernetes Status Docker Containers: Homebrew: Install.sh: Install.ps1: macOS Pkg: Arch Linux: Installation The easiest way to install mql & cnspec is to use the install scripts. via Shell Script Linux and macOS...

EUVD-2026-80048

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious cod...

EUVD-2026-80036

NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval in qosxianzaddcgi, qosxianzshowcgi, qosfilteraddcgi, and qosfiltershowcgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is...

PT-2026-93772

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description Insufficient validation of calls from sandboxed scripts to methods added dynamically to a class at runtime allows users with permissions to define and run...

CVE-2026-27565: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot...

CVE-2026-92625: Missing Authentication for Critical Function

Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/license/restartService endpoint is reachable without authentication and invokes an internal routine that terminates the iDSecure service process and relaunches it by way of a generated bat...

CVE-2026-88976: Improper Neutralization of Input During Web Page Generation

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs,...

CVE-2026-92128: Download of Code Without Integrity Check

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary code in the context ...

CVE-2026-92122: Protection Mechanism Failure

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define an...

CVE-2026-92129: Protection Mechanism Failure

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute...

CVE-2026-92126: Use of Externally-Controlled Input to Select Classes or Code

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable...

CVE-2026-92125: Improper Control of Generation of Code

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox...

CVE-2026-73169: Improper Neutralization of Input During Web Page Generation

Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in the Modbus transaction management interface of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to store...

PT-2026-93771

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description The plugin downloads a JAR file from a specified URL twice. It confirms the approval of the first download but loads the classpath entries from the second. This...

PT-2026-93769

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description Users with permission to define and run sandboxed scripts, such as Pipelines, can execute code outside the sandbox. This occurs because the plugin fails to reje...

PT-2026-93768

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description The plugin fails to reject the @GroovyASTTransformationClass annotation. This allows users with permissions to define and execute sandboxed scripts, such as...

PT-2026-93767

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description An issue exists where the plugin incorrectly validates operations performed by Groovy when a sandboxed script casts a collection to another type. Because the ca...

PT-2026-93719

Name of the Vulnerable Software and Affected Versions Advantech EKI-1242EIMS version V1.06.01 Description The Modbus transaction management interface contains a Cross-site Scripting XSS issue, which occurs when an application includes untrusted data in a web page without proper validation or...

PT-2026-93977

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web-based management interface...

PT-2026-93766

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description Attackers with permission to define and run sandboxed scripts, including Pipelines, can bypass sandbox protection to execute arbitrary code in the context of th...