21960 matches found
CVE-2026-8470
IBM Langflow OSS versions 1.0.0–1.10.3 generate Fernet encryption keys from user secrets using Python’s non-cryptographic random module. The deterministic Mersenne Twister PRNG yields identical keys for identical seeds, enabling an attacker to reproduce encryption keys and decrypt stored API keys...
CVE-2026-70447
Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2026-70447
CVE-2026-70447 affects Jenkins AWS CodeBuild Plugin 0.59 and earlier. The root cause is missing permission checks on HTTP endpoints, allowing users with Overall/Read to enumerate credential IDs stored in Jenkins. Impact is credential enumeration, which can facilitate credential access in conjunct...
CVE-2026-70446
Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2026-70445
Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2026-70446
Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2026-70445
The CVE-2026-70445 entry concerns Jenkins Sauce OnDemand Plugin (2.2.0 and earlier). The root cause is missing permission checks in HTTP endpoints, enabling users with Overall/Read permission to enumerate credentials IDs stored in Jenkins. Reported impact is credential enumeration; exploitation s...
CVE-2026-70444
A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2026-70444
A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2026-70444
The CVE covers a missing permission check in the Jenkins Violation Comments to GitLab Plugin (versions 2.62.0 and earlier). The underlying issue is an HTTP endpoint that does not enforce correct permissions, allowing users with Overall/Read privileges to enumerate credentials IDs stored in Jenkin...
CVE-2026-70442
Jenkins Google Chat Notification Plugin 166.ve6bde280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to use...
CVE-2026-70438
A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2026-70438
A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2026-70438
CVE-2026-70438 relates to a missing permission check in Jenkins’ Parameterized Remote Trigger Plugin (version 3.2.2 and earlier). The underlying vulnerability allows users with Overall/Read permission to enumerate credentials IDs stored in Jenkins, through vulnerable HTTP endpoints. The root caus...
CVE-2026-70435
A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...
CVE-2026-70435
CVE-2026-70435 : A missing permission check in Jenkins SCM-Manager Plugin (1.11.1 and earlier) allows a user with Overall/Read permission to trigger outbound connections to an attacker-specified URL using attacker-specified credentials IDs, potentially exfiltrating credentials stored in Jenkins. ...
CVE-2026-70434
A cross-site request forgery CSRF vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...
CVE-2026-70433
Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...