CVE-2026-57307

A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b450b1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

EUVD-2026-38788

A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b450b1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2026-57307

A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b450b1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2026-57304

A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password...

CVE-2026-57304

A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password...

CVE-2026-57298

The Jenkins Contrast Continuous Application Security Plugin (version 3.11 and earlier) contains a cross-site request forgery (CSRF) vulnerability and a missing permission check in an HTTP endpoint used to test connections to a Contrast TeamServer. This allows attackers with Overall/Read permissio...

CVE-2026-57297

A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key...

CVE-2026-57297

A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key...

CVE-2026-57294

A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins...

CVE-2026-57294

The Jenkins EC2 Fleet Plugin version 4.2.3.539.v8fedff2a_81c3 and earlier is vulnerable to a missing permission check in several HTTP endpoints used to validate cloud configurations. This flaw allows attackers with Overall/Read permission to connect to an attacker-specified URL using credentials ...

EUVD-2026-38773

A cross-site request forgery CSRF vulnerability in Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method...

CVE-2026-57292

The Jenkins Gitee Plugin (version 1288.v18b_deb_c9069b and earlier) is vulnerable to a cross-site request forgery (CSRF) attack. The root cause is that several HTTP endpoints used for global configuration form validation lack sufficient permission checks and do not require POST requests. This all...

CVE-2026-57292

A cross-site request forgery CSRF vulnerability in Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method...

CVE-2026-57291

The Jenkins Gitee Plugin (version 1288.v18b_deb_c9069b_ and earlier) contains missing permission checks in several HTTP endpoints used for global configuration form validation. This allows an attacker with Overall/Read permission to force the application to connect to an attacker-specified URL us...

PT-2026-51808

A cross-site request forgery CSRF vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers to have Jenkins connect to an attacker-specified URL using an attacker-specified username, API key, and service key...

PT-2026-51817

A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b 450b 1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

PT-2026-51801

Missing permission checks in Jenkins Gitee Plugin 1288.v18b deb c9069b and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method...

PT-2026-51804

A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a 81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins...

CVE-2026-54304

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node's report download...

MAL-2026-5889 Malicious code in @dsft/ft-element (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a7ba80413e901c3cf618c92bd61dc6942bf167fac46b0dc7c554a4a06f705c1 On npm install, the package's preinstall hook preinstall: node index.js in package.json executes index.js, which reads process.env.INITCWD, derives t...