CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin (version 26.1.0 and earlier) allow an attacker with Overall/Read permission to enumerate the IDs of credentials stored in Jenkins. The CVSS v3.1 base score is 5.4 (Medium) , reflecting a network-vector attack with low complexity and ...

EUVD-2026-70147

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

velociraptor_CVE-2025-6264_PoC

CVE-2025-6264 DISCLAIMER: This is an educational research project. I did not discover this vulnerability. This repository demonstrates CVE-2025-6264 for learning purposes Affected versions before 0.74.3 Affects Windows, MacOS and Linux The Admin.Client.UpdateClientConfig artifact is missing...

CVE-2026-75339

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...

CVE-2026-75339

cjbi admin3 v3.0.0 suffers from missing permission checks on the /storage/upload storage endpoint. Any logged-in user can upload arbitrary files, while any anonymous attacker can download them, enabling unauthorized file access and potential data exposure. The CVSS v3.1 score is 8.8 (High) (AV:N/...

CVE-2026-75339

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...

CVE-2026-77507

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and...

CVE-2026-73239 Apache Allura: Missing permission checks IDOR

Insecure Direct Object Reference IDOR due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

EUVD-2026-57370

Insecure Direct Object Reference IDOR due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-70447

CVE-2026-70447 affects Jenkins AWS CodeBuild Plugin 0.59 and earlier. The root cause is missing permission checks on HTTP endpoints, allowing users with Overall/Read to enumerate credential IDs stored in Jenkins. Impact is credential enumeration, which can facilitate credential access in conjunct...

CVE-2026-70439

Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality...

Missing permission checks in Parameterized-Remote-Trigger allow enumerating credentials IDs

Parameterized-Remote-Trigger 3.2.2 and earlier does not perform permission checks in HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Details RemoveDependency in routers/web/repo/issuedependency.go takes a removeDependencyID form parameter identifying the other issue by its global numeric ID, and fetches it with issuesmodel.GetIssueByIDctx, depID - no repository or permission check at all. It then calls...

Improper Authorization

Apollo Portal is vulnerable to Improper Authorization. The vulnerability is due to missing application and namespace permission checks when retrieving releases by ID, which allows an authenticated low-privileged user to access unauthorized release data by supplying a valid release ID...

PYSEC-2026-481 praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}

Summary Type: Vertical privilege escalation. The PATCH /workspaces/workspaceid/members/userid endpoint is gated by requireworkspacememberworkspaceid, which defaults to minrole="member" and is never overridden by the route. The handler then calls MemberService.updateroleworkspaceid, userid,...

EUVD-2026-38772

Missing permission checks in Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method...

CVE-2026-57291

CVE-2026-57291 affects Jenkins Gitee Plugin (version 1288.v18b_deb_c9069b_ and earlier). The issue is missing permission checks in the plugin, allowing attackers with Overall/Read permissions to connect to an attacker-controlled URL using attacker-controlled credentials IDs obtained through anoth...