Lucene search
+L

3901 matches found

Vulnrichment
Vulnrichment
•added 2026/09/02 3:40 p.m.•9 views

CVE-2026-84647

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

5.9AI score0.00518EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/02 3:40 p.m.•39 views

CVE-2026-84647

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

0.00518EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/02 1:39 a.m.•53 views

CVE-2026-82968 Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacke...

6.4CVSS0.00277EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
•added 2026/09/02 12:00 a.m.•15 views

Jenkins plugins Multiple Vulnerabilities (2026-09-02)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Customizable Header Plugin 295.v2544bca19b97 and earlier allows overwriting the plugin's appearance configuration through Stapler...

5.8AI score0.01159EPSS
SaveExploits1References23
Positive Technologies
Positive Technologies
•added 2026/09/02 12:00 a.m.•25 views

PT-2026-84777

In Stapler 2107.v8dfcb e8ed317 and earlier, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify...

5.4CVSS5.9AI score0.00251EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/02 12:00 a.m.•20 views

PT-2026-84782

Jenkins Script Security Plugin 1412.v7737b 3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...

5.9AI score0.00281EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/02 12:00 a.m.•0 views

CVE-2026-84659: Missing Authorization

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...

4.3CVSS5.8AI score0.00281EPSS
SaveExploits0References3
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/02 12:00 a.m.•0 views

CVE-2026-84668: Improper Access Control

Jenkins SAML Plugin 4.618.v441a27fa46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user...

8.8CVSS5.8AI score0.00417EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/02 12:00 a.m.•0 views

CVE-2026-84647: Deserialization of Untrusted Data

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

8.8CVSS5.9AI score0.00518EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/02 12:00 a.m.•19 views

PT-2026-84787

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

5.9AI score0.00136EPSS
SaveExploits0References2
Jenkins Security Advisories
Jenkins Security Advisories
•added 2026/09/02 12:00 a.m.•11 views

Path traversal vulnerability in file-parameters can lead to RCE

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor and binding submitted data to their arguments. file-parameters validates...

8.8CVSS6.2AI score0.00835EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
•added 2026/09/02 12:00 a.m.•12 views

Improper access control in script-security

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties...

4.3CVSS5.9AI score0.00313EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
•added 2026/09/02 12:00 a.m.•13 views

Improper access control in jobConfigHistory

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties...

5.4CVSS5.9AI score0.00136EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
•added 2026/09/02 12:00 a.m.•11 views

Form submission data binding can set static fields

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of...

5.4CVSS5.8AI score0.00251EPSS
SaveExploits0Affected Software1
Positive Technologies
Positive Technologies
•added 2026/09/02 12:00 a.m.•18 views

PT-2026-84791

Name of the Vulnerable Software and Affected Versions Jenkins SAML Plugin versions prior to 4.618.v441a 27fa 46d2 Description Improper access control allows authenticated users to overwrite the SAML identity provider metadata file via Stapler data binding. This enables an attacker to replace the...

8.8CVSS5.3AI score0.00417EPSS
SaveExploits0References3
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/02 12:00 a.m.•1 views

CVE-2026-84666: Improper Input Validation

Jenkins Job Configuration History Plugin 1367.vc8fab15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings...

5.4CVSS5.8AI score0.00136EPSS
SaveExploits0References3
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/02 12:00 a.m.•0 views

CVE-2026-84654: External Control of Assumed-Immutable Web Parameter

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

5.4CVSS5.8AI score0.00251EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/09/02 12:00 a.m.•16 views

PT-2026-84790

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups...

5.9AI score0.00377EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/02 12:00 a.m.•0 views

CVE-2026-84662: URL Redirection to Untrusted Site

Jenkins LDAP Plugin 807.809.vd3a4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an attacker-specified URL...

4.3CVSS5.8AI score0.00254EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/02 12:00 a.m.•0 views

CVE-2026-84664: Modification of Assumed-Immutable Data (MAID)

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

5.4CVSS5.8AI score0.00136EPSS
SaveExploits0References3
Rows per page
Query Builder