CVE-2026-94145

A cross-site scripting (XSS) vulnerability affects xuxueli xxl-job versions up to 3.4.2/3.5.0 , specifically in the Task Management Interface component. The flaw resides in JobInfoController.java and is triggered by manipulation of the name or author argument, allowing a remote attacker with low ...

CVE-2026-94145 xuxueli xxl-job Task Management JobInfoController.java cross site scripting

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/autho...

EUVD-2026-83844

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/autho...

CVE-2026-94145

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/autho...

CVE-2026-94145: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/autho...

CVE-2026-68919: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials when rendering the Stage Detail, Job/Build Detail, Value Stream Map, and Pipeline...

CVE-2026-94426: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

PT-2026-96046

Name of the Vulnerable Software and Affected Versions xuxueli xxl-job versions 3.4.2 and 3.5.0 Description A cross site scripting issue exists in the Task Management Interface within the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java. A remote attack...

PT-2026-96117

Name of the Vulnerable Software and Affected Versions GoCD versions prior to 26.1.0 Description The internal GoCD UI '/jobStatus.json' API fails to validate if a requested server-assigned job ID belongs to the specified pipeline and stage. This allows an authenticated user to guess job IDs and...

PT-2026-96136

Name of the Vulnerable Software and Affected Versions GoCD versions 13.3.0 through 26.0.x Description GoCD fails to correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials. This occurs when rendering the Stage Detail,...

PT-2026-96319

Name of the Vulnerable Software and Affected Versions xuxueli xxl-job versions prior to 3.5.1 Description A remote attacker can initiate cross site scripting XSS—a technique used to inject malicious scripts into web pages viewed by other users—by manipulating the Name argument within an unknown...

SUSE CVE-2026-89862

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix BSG job leak on validate flash image error path qla28xxvalidateflashimage returns QLASUCCESS 0 unconditionally, telling the FC BSG transport fcbsghostdispatch that the driver owns and will complete the request...

SUSE CVE-2026-89867

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Defer jobfinish only when a DECPIC was queued Decoder instances sharing a VPU also share one v4l2m2m job slot, released when the running context calls v4l2m2mjobfinish. While draining, devicerun defers...

CVE-2026-93295: Improper Neutralization of Special Elements in Output Used by a Downstream Component

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::parsePaths scans the entire argv for path switches -app,...

PT-2026-94248

A flaw was found in the foreman remote execution plugin's template invocations controller. The show template invocation by host action resolves the job invocation by ID without evaluating the caller's view job invocations permission filter against the record. An authenticated user whose job...

PT-2026-94988

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/v3d component where the run job callbacks for BIN, RENDER, TFU, and CSD assign an incoming job to queue-active job before calling v3d fence create. If v3d fenc...

DEBIAN-CVE-2026-89862

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix BSG job leak on validate flash image error path qla28xxvalidateflashimage returns QLASUCCESS 0 unconditionally, telling the FC BSG transport fcbsghostdispatch that the driver owns and will complete the request...

CVE-2026-89862

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix BSG job leak on validate flash image error path qla28xxvalidateflashimage returns QLASUCCESS 0 unconditionally, telling the FC BSG transport fcbsghostdispatch that the driver owns and will complete the request...

CVE-2026-89867

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Defer jobfinish only when a DECPIC was queued Decoder instances sharing a VPU also share one v4l2m2m job slot, released when the running context calls v4l2m2mjobfinish. While draining, devicerun defers...

CVE-2026-89867 media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Defer jobfinish only when a DECPIC was queued Decoder instances sharing a VPU also share one v4l2m2m job slot, released when the running context calls v4l2m2mjobfinish. While draining, devicerun defers...