CVE-2026-57302

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system...

CVE-2026-57296

The Jenkins External Workspace Manager Plugin (version 1.3.2 and earlier) contains a path traversal vulnerability. The plugin fails to reject .. path segments when validating the custom workspace path provided to the exwsAllocate Pipeline step, allowing the path to escape the configured disk moun...

CVE-2026-57296

Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can...

PT-2026-51811

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller...

CVE-2026-57302: Plaintext Storage of a Password

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system...

Passwords stored in plain text by fitnesse

fitnesse 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory, the...

Builds executed on the Jenkins controller by zapper can lead to RCE

zapper 1.0.7 and earlier does not support distributed builds, causing the file operations and build process of its "Automatically build ZAP" feature to be performed on the Jenkins controller rather than on the agent the build is assigned to. This allows attackers with Item/Configure permission to...

PT-2026-51812

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system...

RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security Update (Critical) (RHSA-2026:28376)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:28376 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers ca...

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization due to insufficient permission checks in the store method of the UsersController. An attacker can assign full administrative privileges to a newly...

Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the BulkAssetsController::update process. An attacker can gain unauthorized access to assets belonging to other companies...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

GHSA-25MH-HP8X-CGRV vulnerabilities

Vulnerabilities for packages: virt-controller-fips, harvester, virt-launcher, docker-machine-driver-harvester, virt-operator-fips, virt-handler, harvester-fips...

GHSA-4Q63-MR2M-57HF vulnerabilities

Vulnerabilities for packages: virt-controller-fips, harvester, virt-launcher, virt-operator-fips, virt-operator, harvester-fips...

GHSA-VJHF-6XFR-5P9G vulnerabilities

Vulnerabilities for packages: virt-controller-fips, harvester, virt-launcher, virt-operator-fips, virt-operator, harvester-fips...

CVE-2025-14525 vulnerabilities

Vulnerabilities for packages: virt-controller-fips, harvester, virt-launcher, docker-machine-driver-harvester, virt-operator-fips, virt-handler, harvester-fips...

CVE-2024-33394 vulnerabilities

Vulnerabilities for packages: virt-controller-fips, harvester, virt-launcher, virt-operator-fips, virt-operator, harvester-fips...

CVE-2024-31420 vulnerabilities

Vulnerabilities for packages: virt-controller-fips, harvester, virt-launcher, virt-operator-fips, virt-operator, harvester-fips...

GHSA-RJFV-PJVX-MJGV vulnerabilities

Vulnerabilities for packages: aws-load-balancer-controller-fips, aws-load-balancer-controller...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: cortex, crossplane-provider-keycloak, crossplane-provider-azure-servicelinker, guac, metallb, tekton-pipelines-fips, cert-manager-openshift-routes, go-getter, kubevirt-cdi-uploadserver, minio, secrets-store-csi-driver-provider-gcp-fips, kubescape-operator,...