org.jenkins-ci.plugins:vectorcast-execution (>=0.16, <=0.61) potentially affected by CVE-2026-9674 via org.jenkins-ci.plugins:jenkins-multijob-plugin (1.21)

org.jenkins-ci.plugins:jenkins-multijob-plugin MAVEN version 1.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:jenkins-multijob-plugin and may be impacted: - org.jenkins-ci.plugins:vectorcast-execution =0.16, =0.61 Source cves...

org.zeroturnaround.jenkins:build-flow-test-aggregator (>=1.1, <=1.2) potentially affected by CVE-2026-9674 via org.jenkins-ci.plugins:jenkins-multijob-plugin (1.16)

org.jenkins-ci.plugins:jenkins-multijob-plugin MAVEN version 1.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:jenkins-multijob-plugin and may be impacted: - org.zeroturnaround.jenkins:build-flow-test-aggregator =1.1, =1.2...

GHSA-P8JH-4P5P-2RFP Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint

Jenkins Job Import Plugin 143.v044a2e819b27 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials usin...

Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint

Jenkins Job Import Plugin 143.v044a2e819b27 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials usin...

org.jenkins-ci.plugins:email-ext-recipients-column (1.0), org.jenkins-ci.plugins:job-direct-mail (>=1.1, <=1.5) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (2.25)

org.jenkins-ci.plugins:email-ext MAVEN version 2.25 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkins-ci.plugins:email-ext-recipients-column 1.0 - org.jenkins-ci.plugins:job-direct-mail...

EUVD-2026-32264

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Stop job scheduling across aie2releaseresource Running jobs on a hardware context while it is in the process of releasing resources can lead to use-after-free and crashes. Fix this by stopping job scheduling before...

CVE-2026-9712

When creating an export through the pretix API, API clients are returned an UUID value for their export job a long, random string like 35742818-c375-4d15-839f-d49aecce94d6. Using this UUID, the API client can then request the actual file for download. The same kind of UUID is used in other places...

CVE-2026-48926

Jenkins Job Import Plugin 143.v044a2e819b27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-48927

Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs or views...

CVE-2026-48926

Jenkins Job Import Plugin 143.v044a2e819b27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-37712

An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/cron/class/cronjob.class.php, calluserfuncarray in function job type...

CVE-2026-46058

In the Linux kernel, the following vulnerability has been resolved: media: amphion: Fix race between m2m jobabort and devicerun Fix kernel panic caused by race condition where v4l2m2mctxrelease frees m2mctx while v4l2m2mtryrun is about to call devicerun with the same context. Race sequence:...

UBUNTU-CVE-2026-46058

In the Linux kernel, the following vulnerability has been resolved: media: amphion: Fix race between m2m jobabort and devicerun Fix kernel panic caused by race condition where v4l2m2mctxrelease frees m2mctx while v4l2m2mtryrun is about to call devicerun with the same context. Race sequence:...

UBUNTU-CVE-2026-45980

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Stop job scheduling across aie2releaseresource Running jobs on a hardware context while it is in the process of releasing resources can lead to use-after-free and crashes. Fix this by stopping job scheduling before...

org.jenkins-ci.plugins:feature-branch-notifier (>=1.0, <=1.4), org.jenkins-ci.plugins:vectorcast-execution (>=0.16, <=0.61) +1 more potentially affected by CVE-2026-9674 via org.jenkins-ci.plugins:jenkins-multijob-plugin (>=1.9, <=1.21)

org.jenkins-ci.plugins:jenkins-multijob-plugin MAVEN version =1.9, =1.0, =0.16, =1.1, =1.2 Source cves: CVE-2026-9674 Source advisory: MEND:CVE-2026-9674...

CVE-2026-48926

Jenkins Job Import Plugin 143.v044a2e819b27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-48926

Jenkins Job Import Plugin 143.v044a2e819b27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-48926

Jenkins Job Import Plugin 143.v044a2e819b27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

EUVD-2026-32517

Jenkins Job Import Plugin 143.v044a2e819b27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-48926

The Jenkins Job Import Plugin (version 143.v044a_2e819b_27 and earlier) is vulnerable to a missing permission check in an HTTP endpoint. This flaw allows attackers with Overall/Read permissions to enumerate credentials IDs for secrets stored in Jenkins. These IDs could be leveraged in subsequent ...