180431 matches found
CVE-2026-84657
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...
EUVD-2026-70123
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...
CVE-2026-84657
In Jenkins 2.579 and earlier (LTS 2.568.2 and earlier), the build CLI command with the -s flag does not check the Item/Cancel permission when canceling a build after the CLI client is interrupted. Because Jenkins merges duplicate build requests into a single queue item, an attacker holding only I...
CVE-2026-84653
Jenkins versions 2.421 through 2.579 and LTS 2.426.1 through 2.568.2 contain an incorrect permission check in the Appearance configuration page (introduced in Jenkins 2.421). Attackers holding the Overall/Manage permission can modify Appearance configuration options that should be restricted to a...
CVE-2026-84653
Jenkins 2.421 through 2.579 both inclusive, LTS 2.426.1 through 2.568.2 both inclusive does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to...
EUVD-2026-70118
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...
EUVD-2026-64336
NLTK: Default ENFORCE=False Disables All pathsec Security Controls...
CVE-2026-79990
Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...
CVE-2026-79989
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission which doesn’t allow changing...
CVE-2026-78153
The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...
CVE-2026-2688
The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...
CVE-2026-17563
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...
CVE-2025-8945
The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...
CVE-2025-15490
The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...
EUVD-2026-61222
fastify vulnerable to X-Forwarded- spoofing under trustProxy hop-count...
EUVD-2026-61221
fastify vulnerable to schema validation bypass via root primitive coercion mismatch...
Sulu: Fix authorization bypass when creating preview links
Impact A missing authorization check on the preview link endpoint lets a backend user create a public, unauthenticated preview URL for content they are not allowed to see. PreviewLinkController and the underlying PreviewLinkManager::generate / revoke never enforced a permission on the target...
EUVD-2026-68888
Sulu: Media move/update authorization bypass IDOR...