io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53440 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53440 Source advisory: GHSA-92M7-4FPW-2WXM...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53438 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53438 Source advisory: OSV:GHSA-MW82-XCG6-GX79...

org.jenkins-ci.main:jenkins-test-harness (1.642), org.jenkins-ci.main:jenkins-war (1.642) +6 more potentially affected by CVE-2026-53435 via org.jenkins-ci.main:jenkins-core (1.642)

org.jenkins-ci.main:jenkins-core MAVEN version 1.642 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.642 - org.jenkins-ci.main:jenkins-war 1.642 -...

com.gurkensalat.jenkins-ci.plugins:transifex (0.1.0), com.rubiconred.jenkins:myst-plugin (>=2.4.3.1, <=2.5.0.0) +39 more potentially affected by CVE-2026-53440 via org.jenkins-ci.main:jenkins-core (1.509.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.509.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.gurkensalat.jenkins-ci.plugins:transifex 0.1.0 - com.rubiconred.jenkins:myst-plugin...

org.jenkins-ci.main:jenkins-test-harness (1.642), org.jenkins-ci.main:jenkins-war (1.642) +6 more potentially affected by CVE-2026-53437 via org.jenkins-ci.main:jenkins-core (1.642)

org.jenkins-ci.main:jenkins-core MAVEN version 1.642 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.642 - org.jenkins-ci.main:jenkins-war 1.642 -...

com.tikalk.hudson.plugins:notification (1.10), org.jenkins-ci.main:jenkins-test-harness (1.605) +5 more potentially affected by CVE-2026-53438 via org.jenkins-ci.main:jenkins-core (1.605)

org.jenkins-ci.main:jenkins-core MAVEN version 1.605 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.tikalk.hudson.plugins:notification 1.10 - org.jenkins-ci.main:jenkins-test-harness 1.605 -...

org.jenkins-ci.main:jenkins-test-harness (1.468), org.jenkins-ci.main:jenkins-war (1.468) +7 more potentially affected by CVE-2026-53435 via org.jenkins-ci.main:jenkins-core (1.468)

org.jenkins-ci.main:jenkins-core MAVEN version 1.468 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.468 - org.jenkins-ci.main:jenkins-war 1.468 -...

CVE-2026-45556

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf///rule//save accepts a configfilename form field that is passed straight through to configmod.masterslaveuploadandrestart... as the destination path. The validation chai...

CVE-2026-53442

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to t...

EUVD-2026-36038

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf///rule//save accepts a configfilename form field that is passed straight through to configmod.masterslaveuploadandrestart... as the destination path. The validation chai...

CVE-2026-45556 Roxy-WI: Authenticated arbitrary file write on every managed load balancer (and downstream RCE) via WAF rule save `config_file_name`

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf///rule//save accepts a configfilename form field that is passed straight through to configmod.masterslaveuploadandrestart... as the destination path. The validation chai...

CVE-2026-45556

Roxy-WI (versions &lt;= 8.2.6.4) is affected by CVE-2026-45556. The vulnerability arises in POST /waf///rule//save: the config_file_name field is passed to config_mod.master_slave_upload_and_restart(...) as the destination path. The validation only checks that the path contains a service substrin...

CVE-2026-45556 Roxy-WI: Authenticated arbitrary file write on every managed load balancer (and downstream RCE) via WAF rule save `config_file_name`

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf///rule//save accepts a configfilename form field that is passed straight through to configmod.masterslaveuploadandrestart... as the destination path. The validation chai...

CVE-2026-53442

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to t...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53442 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53442 Source advisory: MEND:CVE-2026-53442...

CVE-2026-53442

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to t...

EUVD-2026-36026

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to t...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53439 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53439 Source advisory: MEND:CVE-2026-53439...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53440 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53440 Source advisory: MEND:CVE-2026-53440...

io.jenkins.plugins:design-library (434.v01b_a_5a_27a_53c), org.jenkins-ci.main:jenkins-war (>=2.556, <=2.567) +3 more potentially affected by CVE-2026-53437 via org.jenkins-ci.main:jenkins-core (>=2.556, <=2.567)

org.jenkins-ci.main:jenkins-core MAVEN version =2.556, =2.556, =1573.v1465f6f78810, =878.v6f1d3b3a0769, =898.vc050ed2424ca - org.jvnet.hudson.plugins:favorite 2.267.vb90d08408081 Source cves: CVE-2026-53437 Source advisory: MEND:CVE-2026-53437...