67741 matches found
PT-2026-84706
Name of the Vulnerable Software and Affected Versions Rentsyst versions prior to 2.1.3 Description A missing authorization issue allows the exploitation of incorrectly configured access control security levels. Recommendations Update Rentsyst to a version newer than 2.1.2...
PT-2026-84773
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used...
CVE-2026-84650: Deserialization of Untrusted Data
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used...
CVE-2026-84654: External Control of Assumed-Immutable Web Parameter
In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...
PT-2026-84774
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure...
The vulnerability of the `updateUser` command in the MongoDB database management system allows attackers to increase their privileges.
The vulnerability of the updateUser command in the MongoDB database management system is related to incorrect input of configuration data. Exploiting this vulnerability allows a malicious actor to increase their privileges remotely...
Optical Side-Channel Probing of the Internal Configuration Access Port (ICAP) on AMD 7-Series FPGAs
Revisions Revision Date| Description ---|--- 2026-09-14| Acknowledgement updates 2026-09-02| Initial version...
CVE-2026-84666: Improper Input Validation
Jenkins Job Configuration History Plugin 1367.vc8fab15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings...
F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K000161728)
The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.4 / 17.5.1.8 / 21.1.0.1. It is, therefore, affected by a vulnerability as referenced in the K000161728 advisory. A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker ...
F5 Networks BIG-IP : BIG-IP and BIG-IQ Configuration utility vulnerability (K000162521)
The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.4 / 17.5.1.8 / 21.0.0.3 / 21.1.0.1. It is, therefore, affected by a vulnerability as referenced in the K000162521 advisory. BIG-IP has a vulnerability where an authenticated user of any role may be able to create...
CVE-2026-84658: Exposure of Sensitive Information to an Unauthorized Actor
Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...
PT-2026-84776
Name of the Vulnerable Software and Affected Versions Jenkins versions 2.421 through 2.579 Jenkins LTS versions 2.426.1 through 2.568.2 Description Insufficient permission checks on the Appearance configuration page allow users with Overall/Manage permissions to modify configuration options they...
CVE-2026-84653: Missing Authorization
Jenkins 2.421 through 2.579 both inclusive, LTS 2.426.1 through 2.568.2 both inclusive does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to...
CVE-2026-66362: Improper Neutralization of Equivalent Special Elements
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...
PT-2026-84762
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...
jenkins -- multiple vulnerabilities
Jenkins Security Advisory 2026-09-02: High SECURITY-3972 / CVE-2026-84645: Deserialization vulnerability Medium SECURITY-3908 / CVE-2026-84646: Lack of type restriction in deserialization High SECURITY-3915 / CVE-2026-84647: Instantiation of any types related to configuration High SECURITY-3967 /...
PT-2026-84777
In Stapler 2107.v8dfcb e8ed317 and earlier, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify...
JFrog Artifactory Improper Authentication Vulnerability
JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges...
Unsafe deserialization allows overwriting configuration objects
In Jenkins, fields declared transient are excluded from serialization but are still read back during deserialization for backward compatibility with existing configuration files. In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization,...
Form submission data binding can set static fields
Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of...