CVE-2026-53441

Jenkins 2.483 through 2.567 both inclusive, LTS 2.492.1 through 2.555.2 both inclusive does not escape the user-provided description of a generic offline cause that could be set through the POST config.xml API, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers...

CVE-2026-45564

CVE-2026-45564 affects Roxy-WI web interface for managing HAProxy/Nginx/Apache/Keepalived. In versions up to and including 8.2.6.4, POST /config/versions////save interpolates the URL-path parameter directly into a config-version path that resolves to a shell command: os.system("dos2unix -q {cfg}...

CVE-2026-45549 Roxy-WI: Authorization bypass on POST /smon/agent/action/<action> — guest can stop or restart smon-agent on any host

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, agentaction app/routes/smon/agentroutes.py:166-179 has decorators @bp.post'/agent/action/' and @jwtrequired only — no role check, no group ownership check on the serverip form...

CVE-2026-45549

CVE-2026-45549 affects Roxy-WI web interface for managing HAProxy/Nginx/Apache/Keepalived. In versions 8.2.6.4 and prior, the code path agent_action (app/routes/smon/agent_routes.py:166-179) uses @bp.post('/agent/action/') and @jwt_required() with no role or group ownership check on the server_ip...

CVE-2026-45549 Roxy-WI: Authorization bypass on POST /smon/agent/action/<action> — guest can stop or restart smon-agent on any host

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, agentaction app/routes/smon/agentroutes.py:166-179 has decorators @bp.post'/agent/action/' and @jwtrequired only — no role check, no group ownership check on the serverip form...

CVE-2026-49740

creationtimestamp| type| source ---|---|--- 2026-06-10 13:15:35+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnws6y5lau2n...

CVE-2026-47351

creationtimestamp| type| source ---|---|--- 2026-06-10 13:15:35+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnws6y5lau2n...

CVE-2026-47352

creationtimestamp| type| source ---|---|--- 2026-06-10 13:15:35+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnws6y5lau2n...

CVE-2026-47350

creationtimestamp| type| source ---|---|--- 2026-06-10 13:15:34+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnws6y5lau2n...

CVE-2026-49938

creationtimestamp| type| source ---|---|--- 2026-06-10 13:15:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnws6ecbbi2y...

EUVD-2026-36026

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to t...

CVE-2026-53442

CVE-2026-53442 affects Jenkins 2.567 and earlier, LTS 2.555.2 and earlier. The issue: secrets posted via config.xml are not encrypted before being stored in job config.xml files on the Jenkins controller, allowing disclosure to users with Item/Extended Read permissions or filesystem access. This ...

CVE-2026-53442

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to t...

CVE-2026-53442

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to t...

CVE-2026-53441

Summary: CVE-2026-53441 affects Jenkins core 2.483–2.567 and LTS 2.492.1–2.555.2, where the description field for an offline cause can be stored via the POST config.xml API, enabling stored XSS. This requires attacker permission at Agent/Configure level. What’s known from provided sources: The vu...

CVE-2026-53440

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain...

CVE-2026-8853

creationtimestamp| type| source ---|---|--- 2026-06-10 11:36:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnwmo3qbcp27 2026-06-10 21:16:45+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mnxn3fbuoc2o 2026-06-11 02:23:34+00:00| seen|...

CVE-2026-9019

creationtimestamp| type| source ---|---|--- 2026-06-10 11:31:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnwmf5ckts2r 2026-06-10 18:04:38+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mnxcdurote2a...

GHSA-P58X-R3C9-X9P6

creationtimestamp| type| source ---|---|--- 2026-06-10 11:30:53+00:00| seen| https://bsky.app/profile/hnbot.gsuscs.xyz/post/3mnwmdrqrxc2q 2026-06-10 12:04:33+00:00| seen| https://bsky.app/profile/betterhn20.e-work.xyz/post/3mnwo7xvt7d2u 2026-06-11 01:43:14+00:00| seen|...

CVE-2026-8613

creationtimestamp| type| source ---|---|--- 2026-06-10 11:26:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnwm46rmfh2v 2026-06-11 02:54:23+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mny7x5cvs52w...