CVE-2026-70439

Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality...

CVE-2026-70439

Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality...

EUVD-2026-53533

Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality...

PT-2026-68276

Name of the Vulnerable Software and Affected Versions Jenkins Summary Display Plugin versions 1.15 and earlier Description Stored cross-site scripting XSS occurs in build report pages because the job name is not properly escaped within a JavaScript context. This issue can be exploited by users...

CyberBridge: Bridging the Gap between Cybersecurity Education and Industry

This full research paper presents CyberBridge, a framework that automatically maps cybersecurity job descrip- tions to professional role profiles. As the cybersecurity landscape evolves rapidly, it is difficult for academic programs to align curricula with the competencies expected in practice...

CVE-2026-70439: Missing Authorization

Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality...

CVE-2026-70441: Improper Neutralization of Input During Web Page Generation

Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission...

PT-2026-68274

Name of the Vulnerable Software and Affected Versions Jenkins XML Job to Job DSL Plugin versions prior to 0.1.14 Description The plugin fails to perform necessary permission checks, which allows users without the required privileges to trigger the conversion functionality. Recommendations Update...

Jenkins plugins Multiple Vulnerabilities (2026-08-05)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2... CVE-2026-70426 - Jenkins 2.575 and...

com.aizuda:snail-job-client-common (>=1.0.0-beta1, <=1.10.0-jdk8), com.aizuda:snail-job-client-job-core (>=1.0.0-beta1, <=1.10.0-jdk8) +32 more potentially affected by CVE-2026-69702 via com.aizuda:snail-job-common-core (>=1.0.0-beta1, <=1.10.0-jdk8)

com.aizuda:snail-job-common-core MAVEN version =1.0.0-beta1, =1.0.0-beta1, =1.0.0-beta1, =1.0.0-beta1, =1.0.0-solon, =1.0.0-solon, =1.0.0-beta1, =1.7.0-beta1, =1.0.0-beta1, =1.0.0-beta1, =1.1.0-beta1, =1.2.0-beta1, =1.0.0-beta1, =1.0.0-beta1, =1.0.0-beta1, =1.0.0-beta1, =1.10.0 and more Source...

CVE-2026-18243: Improper Neutralization of Input During Web Page Generation

Certain HP DesignJet products may be potentially vulnerable to cross-site scripting XSS, which may allow unauthenticated HTTP requests to view print job previews...

EUVD-2026-51656

A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...

CVE-2026-52371

A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...

CVE-2026-55825

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The...

CVE-2026-55825 Contao: Possible path traversal in job download URIs

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The...

CVE-2026-55825

CVE-2026-55825 (Contao) : Affected are Contao core-bundle versions 5.7.0–5.7.6. An authenticated backend user who can access one job can craft an attachment identifier containing ../ segments to have the job attachment download endpoint read a file from another job directory inside var/job-attach...

CVE-2026-55825 Contao: Possible path traversal in job download URIs

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The...

CVE-2026-55825 Contao: Possible path traversal in job download URIs

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The...

CVE-2026-55825

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the SanitizeSvgJob process. An attacker can execute arbitrary JavaScript in the context of the application by replacing an existing SVG attachment with a malicious file containing script payloads. This occurs...