PT-2026-90729

Name of the Vulnerable Software and Affected Versions Xuxueli xxl-job versions prior to 3.5.1 Description A remote cross site scripting issue exists in the /jobinfo/insert endpoint. This occurs when the name or author variables are manipulated, allowing an attacker to execute malicious scripts in...

PT-2026-90726

Name of the Vulnerable Software and Affected Versions Xuxueli xxl-job versions prior to 3.4.3 Description Improper privilege management exists in the JobGroupController.java file. This issue allows a remote attacker to manipulate functionality within the...

CVE-2026-90487: Improper Privilege Management

A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launch...

DEBIAN-CVE-2026-89591

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocketioctlsubmitjob releases rjob through rocketjobput on allocation error paths. rocketjobcleanup unconditionally calls rocketiommudomainputjob-domain, but job-domain is...

UBUNTU-CVE-2026-89591

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocketioctlsubmitjob releases rjob through rocketjobput on allocation error paths. rocketjobcleanup unconditionally calls rocketiommudomainputjob-domain, but job-domain is...

CVE-2026-89591 accel/rocket: initialize job domain before cleanup paths

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocketioctlsubmitjob releases rjob through rocketjobput on allocation error paths. rocketjobcleanup unconditionally calls rocketiommudomainputjob-domain, but job-domain is...

CVE-2026-89591

CVE-2026-89591 affects the Linux kernel accel/rocket driver. In rocket_ioctl_submit_job(), error paths release the job via rocket_job_put(), which calls rocket_job_cleanup() and unconditionally invokes rocket_iommu_domain_put(job->domain). However, job->domain is only assigned after task co...

CVE-2026-72710 SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection

SPIP before 4.4.18 contains a mass assignment vulnerability in the editerobjet action that allows unauthenticated attackers to write arbitrary rows to any SQL table lacking a champseditables allowlist by supplying an attacker-controlled arg parameter resolving to internal database tables. Attacke...

CVE-2026-72710

SPIP versions before 4.4.18 contain a critical remote code execution vulnerability in the editer_objet action. The arg parameter resolves SQL table names without enforcing an editable-columns allowlist, allowing an attacker with a valid nonce to supply arg=job/0 with crafted fonction and args val...

CVE-2026-72710 SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection

SPIP before 4.4.18 contains a mass assignment vulnerability in the editerobjet action that allows unauthenticated attackers to write arbitrary rows to any SQL table lacking a champseditables allowlist by supplying an attacker-controlled arg parameter resolving to internal database tables. Attacke...

CVE-2026-86815

The BackWPup WordPress plugin (versions 5.2.2-5.7.4 ) contains a vulnerability where it fails to properly restrict access to specific REST API routes used for managing jobs, backup destinations, and backup executions. This lack of authorization allows users with administrator-assigned limited rol...

EUVD-2026-75782

IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs...

PT-2026-89913

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description A mass assignment issue exists in the editer objet action. Unauthenticated attackers can write arbitrary rows to any SQL table that does not have a champs editables allowlist by providing a controlled...

PT-2026-90307

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel/rocket component where the rocket ioctl submit job function releases rjob via rocket job put during allocation error paths. Because rocket job cleanup...

CVE-2026-81210

IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs...

PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

SummaryPraisonAI's async Jobs API the FastAPI service in praisonai/jobs/ installs its router with no authentication middleware, no router-level dependency, and no per-route auth check. Any caller who can reach the jobs server can submit agent jobs executed against the operator's configured LLM...

CVE-2026-41869

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, use...

CVE-2026-41871 Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. I...

CVE-2026-41871 Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. I...

CVE-2026-41871

Apache Nutch versions 1.10 through 1.22 are vulnerable to a Missing Authorization and Unsafe Reflection vulnerability within the Nutch Server (Nutch REST API) . The root cause involves the use of externally-controlled input to select classes or code, which can lead to unauthenticated reflection-b...