EUVD-2026-70126

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds triggered by the build step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job...

CVE-2026-84660

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds triggered by the build step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job...

CVE-2026-84660

CVE-2026-84660 is a missing permission check in Jenkins Pipeline: Build Step Plugin (versions 599.v4b_67ea_11b_152 and earlier). When a pipeline triggers a downstream build via the build step, the triggered build can be canceled even if the triggering build's credentials lack Item/Cancel permissi...

CVE-2026-84659

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...

CVE-2026-84659

Jenkins Script Security Plugin versions 1412.v7737b_3405f86 and earlier contain a missing permission check in the method that controls the "Force the use of the sandbox globally in the system" setting. An attacker with low privileges can exploit Stapler data binding to disable the global sandbox ...

EUVD-2026-70125

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...

EUVD-2026-70122

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

CVE-2026-84656

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

CVE-2026-84657

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-84656

CVE-2026-84656 (SECURITY-4006) is a missing permission check in Jenkins versions 2.579 and earlier (LTS 2.568.2 and earlier). An attacker holding Item/Read permission on at least one job can read build parameter names and values of other jobs to which they have no access, leading to a low confide...

CVE-2026-84657

CVE-2026-84657 affects Jenkins 2.579 and earlier (LTS 2.568.2 and earlier). The build CLI command fails to check the Item/Cancel permission when using the -s flag to cancel a build that was triggered to wait for completion. As a result, an attacker holding only Item/Build permission can cancel bu...

EUVD-2026-70123

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-84653

Jenkins versions 2.421 through 2.579 (inclusive) and LTS 2.426.1 through 2.568.2 (inclusive) contain an insufficient permission check in the Appearance configuration page. The flaw allows an attacker who already holds the Overall/Manage permission to modify Appearance configuration options they s...

EUVD-2026-70119

Jenkins 2.421 through 2.579 both inclusive, LTS 2.426.1 through 2.568.2 both inclusive does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to...

CVE-2026-84653

Jenkins 2.421 through 2.579 both inclusive, LTS 2.426.1 through 2.568.2 both inclusive does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to...

CVE-2026-84646

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

CVE-2026-84647

CVE-2026-84647 affects the Stapler component in Jenkins 2.579 and earlier and LTS 2.568.2 and earlier (except Stapler version 2088.2093.vd7c3e58008a_6). The vulnerability stems from Stapler failing to restrict the types of objects that can be instantiated via form data binding to those compatible...

EUVD-2026-70112

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

sandbox-runtime

Anthropic Sandbox Runtime srt A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. srt uses native OS sandboxing primitives sandbox-exec on macOS, bubblewrap on Linux and proxy-based network filterin...

CVE-2026-79989

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission which doesn’t allow changing...