Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: mISDN: Fixed a memory leak in dsppipelinebuild. dsppipelinebuild allocates a dup pointer using kstrdupcfg, but then it updates the dup variable using strsep&dup, “|”. As a result, when it calls kfreedup, the dup variable...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via cancellation of downstream builds in Pipeline: Build Step Plugin. An attacker can cancel downstream Jenkins builds without the required Item/Cancel permission because the plugin fails to verify that the build's...

com.testinium.jenkins:testinium (1.0), io.jenkins.blueocean:blueocean (>=1.2.0-beta-1, <=1.27.26) +22 more potentially affected by CVE-2026-84661 via org.jenkins-ci.plugins:pipeline-build-step (>=2.0, <=599.v4b_67ea_11b_152)

org.jenkins-ci.plugins:pipeline-build-step MAVEN version =2.0, =1.2.0-beta-1, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.83.v5bff0e55cd2d, =3.1391.vcbaab9779d75, =877.v578e46d8e5b3, =2.2.0, =2.0, =2.0.5, =2.0.8 - org.jenkins-ci.plugins:convert-to-pipeline 1.0 and more Source...

CVE-2026-84661

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds awaited by the waitForBuild step when the propagateAbort parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream jo...

com.testinium.jenkins:testinium (1.0), io.jenkins.blueocean:blueocean (>=1.2.0-beta-1, <=1.27.26) +22 more potentially affected by CVE-2026-84660 via org.jenkins-ci.plugins:pipeline-build-step (>=2.0, <=599.v4b_67ea_11b_152)

org.jenkins-ci.plugins:pipeline-build-step MAVEN version =2.0, =1.2.0-beta-1, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.83.v5bff0e55cd2d, =3.1391.vcbaab9779d75, =877.v578e46d8e5b3, =2.2.0, =2.0, =2.0.5, =2.0.8 - org.jenkins-ci.plugins:convert-to-pipeline 1.0 and more Source...

Missing permission check in pipeline-build-step allows canceling downstream builds

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. By default, builds run as SYSTEM and are unconstrained unless plugins implement specific additional permission checks. Plugins like Authorize Projec...

CVE-2026-84660: Missing Authorization

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds triggered by the build step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job...

CVE-2026-84661: Missing Authorization

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds awaited by the waitForBuild step when the propagateAbort parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream jo...

Jenkins MCP Server Plugin missing a permission check

Jenkins MCP Server Plugin 0.177.v629fdb2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build. This allows attackers with Item/Read permission to obtain the Pipeline script of jobs. MCP Server Plugin...

hudson.plugins.octopusdeploy:octopusdeploy (4.0.2), org.jenkins-ci.plugins:badge (>=1.0, <=1.1) +2 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.39)

org.jenkins-ci.plugins:script-security MAVEN version 1.39 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - hudson.plugins.octopusdeploy:octopusdeploy 4.0.2 - org.jenkins-ci.plugins:badge =1.0...

hudson.plugins.octopusdeploy:octopusdeploy (4.0.2), org.jenkins-ci.plugins:badge (>=1.0, <=1.1) +2 more potentially affected by CVE-2026-42519 via org.jenkins-ci.plugins:script-security (1.39)

org.jenkins-ci.plugins:script-security MAVEN version 1.39 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - hudson.plugins.octopusdeploy:octopusdeploy 4.0.2 - org.jenkins-ci.plugins:badge =1.0...

CVE-2023-40340

Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask i.e., replace with asterisks credentials specified in the Npm config file in Pipeline build logs...

CVE-2022-23109

Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989228)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989228 advisory. In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsppipelinebuild dsppipelinebuild allocates dup pointer by kstrdupcfg,...

EUVD-2023-2191

Malicious code in bioql PyPI...

EUVD-2022-3197

Malicious code in bioql PyPI...

hudson.plugins.octopusdeploy:octopusdeploy (4.0.2), org.jenkins-ci.plugins:badge (>=1.0, <=1.1) +2 more potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1.39)

org.jenkins-ci.plugins:script-security MAVEN version 1.39 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - hudson.plugins.octopusdeploy:octopusdeploy 4.0.2 - org.jenkins-ci.plugins:badge =1.0...

Linux mISDN dsp_pipeline_build Heap Buffer Overflow DoS

The vulnerability of the dsppipelinebuild function in the mISDN component of the Linux operating system is related to the invocation of the dup variable, which contains NULL. Exploiting this vulnerability could allow an attacker to cause a service failure...

SUSE CVE-2022-48863

In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsppipelinebuild dsppipelinebuild allocates dup pointer by kstrdupcfg, but then it updates dup variable by strsep&dup, "|". As a result when it calls kfreedup, the dup variable contains NULL. Found by...

UBUNTU-CVE-2022-48863

In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsppipelinebuild dsppipelinebuild allocates dup pointer by kstrdupcfg, but then it updates dup variable by strsep&dup, "|". As a result when it calls kfreedup, the dup variable contains NULL. Found by...