EUVD-2026-80748

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast on the collection itself, allowing attackers with permission to define and run...

CVE-2026-92124

The Jenkins Script Security Plugin (version 1415.v9a_f9b_3a_c253d and earlier) is vulnerable to a sandbox bypass due to improper handling of Groovy collection type casting . While the plugin correctly checks operations for elements read from a collection, it incorrectly performs the cast on the c...

CVE-2026-92124

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast on the collection itself, allowing attackers with permission to define and run...

CVE-2026-92123

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not intercept operations performed on a null receiver method calls, property and attribute accesses, and array accesses, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the...

CVE-2026-92122

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define an...

CVE-2026-92123

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not intercept operations performed on a null receiver method calls, property and attribute accesses, and array accesses, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the...

EUVD-2026-80747

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not intercept operations performed on a null receiver method calls, property and attribute accesses, and array accesses, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the...

EUVD-2026-80746

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define an...

CVE-2026-92122

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define an...

CVE-2026-92123

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not intercept operations performed on a null receiver method calls, property and attribute accesses, and array accesses, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the...

CVE-2026-92122

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define an...

CVE-2026-61590 djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in...

djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

Impact djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only DEBUG. In the misconfigured-but-documented scenario DEBU...

libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling

A flaw was found in Libevent. A heap out-of-bounds write vulnerability in the buffereventsocketsetconnaddress function allows an unauthenticated local peer to achieve arbitrary code execution. By connecting to an AFUNIX listener, an attacker can overwrite critical heap data, leading to memory...

Important: Red Hat Security Advisory: libevent security update

An update for libevent is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

EUVD-2026-80699

A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges...

CVE-2026-91843 Stack overflow in login process to the Security Management and Log Servers

A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges...

CVE-2026-91843 Stack overflow in login process to the Security Management and Log Servers

A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges...

CVE-2026-91843

CheckPoint Security Management and Log Servers are affected by a stack overflow in the unauthenticated login process , which may allow a remote attacker to execute arbitrary code with root privileges . The vulnerability is rated CVSS 9.8 (Critical) with a network attack vector requiring no privil...