Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection due to build operations being performed on the Jenkins controller instead of the assigned agent. An attacker can execute arbitrary code on the Jenkins controller by obtaining Item/Configure permission. Remediati...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: usb: ChipIdea UDC: Fix for DMA and SG cleanup in epnuke The ChipIdea UDC driver may encounter errors where “not-page-aligned sg buffers” occur when a USB device is reconnected after being disconnected during an active transfer...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: usb: xhci: Apply the link chain quirk on NEC isoc endpoints Two distinctly different samples of NEC uPD720200 one with a start/stop bug, one without it were observed to cause IOMMU faults after some Missed Service Errors. The...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: i2c: riic: Moving suspend handling to NOIRQ phase Commit 53326135d0e0 “i2c: riic: Adding suspend/resume support” added suspend support for the Renesas I2C driver. Following this change, on RZ/G3E, the following warning appears...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: The admin tagset is released if the initialization fails. The nvmefabrics function creates a NVMe/FC controller in the following path: nvmfdevwrite → nvmfcreatectrl → nvmefccreatectrl → nvmefcinitctrl The nvmefcinitctrl...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: dmaengine: omap-dma: fixed the resource leak in error paths caused by dmapool. The dmapool created by dmapoolcreate is not destroyed when dmaasyncdeviceregister or ofdmacontrollerregister fails, resulting in a resource leak in...

CVE-2026-57302

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system...

CVE-2026-57301

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller...

CVE-2026-57301

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller...

CVE-2026-48142 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller-fips, nginx-stable, ingress-nginx-controller...

GHSA-78JW-WW3G-9WP7 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller-fips, nginx-stable, ingress-nginx-controller...

GHSA-2388-JP8V-FG9W vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller-fips, nginx-stable, ingress-nginx-controller...

CVE-2026-42055 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller-fips, nginx-stable, ingress-nginx-controller...

CVE-2026-42055 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, nginx-stable...

CVE-2026-48142 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, nginx-stable...

GHSA-2388-JP8V-FG9W vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, nginx-stable...

GHSA-78JW-WW3G-9WP7 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, nginx-stable...

CVE-2026-57302

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system...

CVE-2026-57301

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller...

CVE-2026-57302

CVE-2026-57302 affects the Jenkins FitNesse Plugin, specifically version 1.36 and earlier. The root cause is unencrypted password storage in the job config.xml files on the Jenkins controller, enabling disclosure to users with Extended Read permission or anyone with access to the controller files...