io.jenkins.docker:docker-plugin (1336.v3711dec712de), io.jenkins.plugins:docker-slaves (259.v43582a_63e8b_9) +4 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (717.v951d49b_5f3a_a)

org.jenkins-ci.plugins:credentials-binding MAVEN version 717.v951d49b5f3aa is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.docker:docker-plugin 1336.v3711dec712de -...

io.jenkins.plugins:aws-sam (>=1.2.7, <=1.2.13), org.jenkins-ci.plugins:azure-dev-spaces (>=3.0.0, <=3.0.3) +2 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (1.16)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.plugins:aws-sam =1.2.7, =3.0.0, =0.2.1, =2.0.13, =2.0.15 Source...

CVE-2026-42525

Jenkins Microsoft Entra ID previously Azure AD Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...

com.synopsys.jenkinsci:ownership (>=365.v2cc1889ec61d, <=373.vb_41d439617c2), org.jenkins-ci.plugins:azure-ad (>=378.vd6e2874a_69eb, <=678.vf350db_9b_563a) +2 more potentially affected by CVE-2026-42521 via org.jenkins-ci.plugins:matrix-auth (>=3.1.5, <=3.2.9)

org.jenkins-ci.plugins:matrix-auth MAVEN version =3.1.5, =365.v2cc1889ec61d, =378.vd6e2874a69eb, =2.1.0, =1.1.0.227.v27e08dfb1a20, =1.1.0.263.v2e0ddecf8b25 Source cves: CVE-2026-42521 Source advisory: MEND:CVE-2026-42521...

Malicious code in apple-internal-pki-trust (npm)

Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Apple internal infrastructure services authentication, PKI, telemetry, CloudKit, and cloud infrastructure. All packages in this campaign execute credential-theft payloads durin...

MAL-2026-3158 Malicious code in apple-internal-pki-trust (npm)

Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Apple internal infrastructure services authentication, PKI, telemetry, CloudKit, and cloud infrastructure. All packages in this campaign execute credential-theft payloads durin...

Open redirect vulnerability in azure-ad

azure-ad 666.v6060de32f87d and earlier does not restrict the redirect URL after login. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication. azure-ad 667.v4c5827ae74a0 only redirects to...

PT-2026-37115

Name of the Vulnerable Software and Affected Versions OpenTelemetry.Resources.Azure versions prior to 1.15.0-beta.2 Description The AzureVmMetaDataRequestor function makes HTTP requests to the Azure VM instance metadata service and reads the response body into memory without a size limit. An...

org.springframework.ai:spring-ai-starter-vector-store-azure-cosmos-db (>=1.1.0, <=1.1.4) potentially affected by CVE-2026-40978 via org.springframework.ai:spring-ai-azure-cosmos-db-store (>=1.1.0, <=1.1.4)

org.springframework.ai:spring-ai-azure-cosmos-db-store MAVEN version =1.1.0, =1.1.0, =1.1.4 Source cves: CVE-2026-40978 Source advisory: OSV:GHSA-63C8-M9M2-CVR3...

org.springframework.ai:spring-ai-starter-vector-store-azure-cosmos-db (>=1.0.0, <=1.0.5) potentially affected by CVE-2026-40978 via org.springframework.ai:spring-ai-azure-cosmos-db-store (>=1.0.0, <=1.0.5)

org.springframework.ai:spring-ai-azure-cosmos-db-store MAVEN version =1.0.0, =1.0.0, =1.0.5 Source cves: CVE-2026-40978 Source advisory: OSV:GHSA-63C8-M9M2-CVR3...

org.springframework.ai:spring-ai-starter-vector-store-azure-cosmos-db (>=1.0.0, <=1.0.5) potentially affected by CVE-2026-40978 via org.springframework.ai:spring-ai-azure-cosmos-db-store (>=1.0.0, <=1.0.5)

org.springframework.ai:spring-ai-azure-cosmos-db-store MAVEN version =1.0.0, =1.0.0, =1.0.5 Source cves: CVE-2026-40978 Source advisory: GHSA-63C8-M9M2-CVR3...

org.springframework.ai:spring-ai-starter-vector-store-azure-cosmos-db (>=1.1.0, <=1.1.4) potentially affected by CVE-2026-40978 via org.springframework.ai:spring-ai-azure-cosmos-db-store (>=1.1.0, <=1.1.4)

org.springframework.ai:spring-ai-azure-cosmos-db-store MAVEN version =1.1.0, =1.1.0, =1.1.4 Source cves: CVE-2026-40978 Source advisory: GHSA-63C8-M9M2-CVR3...

org.springframework.ai:spring-ai-starter-vector-store-azure-cosmos-db (>=1.1.0, <=1.1.4) potentially affected by CVE-2026-40978 via org.springframework.ai:spring-ai-azure-cosmos-db-store (>=1.1.0, <=1.1.4)

org.springframework.ai:spring-ai-azure-cosmos-db-store MAVEN version =1.1.0, =1.1.0, =1.1.4 Source cves: CVE-2026-40978 Source advisory: MEND:CVE-2026-40978...

org.springframework.ai:spring-ai-starter-vector-store-azure-cosmos-db (>=1.0.0, <=1.0.5) potentially affected by CVE-2026-40978 via org.springframework.ai:spring-ai-azure-cosmos-db-store (>=1.0.0, <=1.0.5)

org.springframework.ai:spring-ai-azure-cosmos-db-store MAVEN version =1.0.0, =1.0.0, =1.0.5 Source cves: CVE-2026-40978 Source advisory: MEND:CVE-2026-40978...

CVE-2026-21515

Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized attacker to elevate privileges over a network...

OPENSUSE-SU-2026:10630-1 azure-storage-azcopy-10.32.2-2.1 on GA media

These are all security issues fixed in the azure-storage-azcopy-10.32.2-2.1 package on the GA media of openSUSE Tumbleweed...

cryptobot-python (0.1.5), ops-py-azure-key-vault-alert (>=7.0.0, <=7.0.1) +2 more potentially affected by CVE-2026-6357 via pip (24.1.0)

pip PYPI version 24.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - cryptobot-python 0.1.5 - ops-py-azure-key-vault-alert =7.0.0, =1.3.1, =2.0.1 Source cves: CVE-2026-6357 Source advisory: OSV:GHSA-JP4C-XJXW-MGF9...

azure-arm-nb-extensions (>=0.0.1, <=0.0.2), cfn-docgen (>=0.0.1, <=0.1.4) +1 more potentially affected by CVE-2026-6357 via pip (20.2.3)

pip PYPI version 20.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - azure-arm-nb-extensions =0.0.1, =0.0.1, =0.0.8, =0.0.11 Source cves: CVE-2026-6357 Source advisory: OSV:GHSA-JP4C-XJXW-MGF9...

A Comparative Evaluation of AI Agent Security Guardrails

This report presents a comparative evaluation of DKnownAI Guard in AI agent security scenarios, benchmarked against three competing products: AWS Bedrock Guardrails, Azure Content Safety, and Lakera Guard. Using human annotation as the ground truth, we assess each guardrail's ability to detect tw...

SQL Injection

Overview org.springframework.ai:spring-ai-azure-cosmos-db-store is a Spring AI Vector Store for Azure Cosmos DB Affected versions of this package are vulnerable to SQL Injection via document ID handling in CosmosDBVectorStore. An attacker can execute arbitrary SQL queries by supplying crafted...