7 matches found
CVE-2026-84655
Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...
CVE-2026-84655
Jenkins versions 2.579 and earlier and LTS 2.568.2 and earlier fail to escape map keys when serializing objects as JSON and Python through its REST API. Attackers who can control map property names can inject arbitrary fields into JSON and Python API responses. CISA ADP assesses exploitation as n...
PT-2026-84778
Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...
PT-2026-59666
Impact A maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payloa...
Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit
ImpactA maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payload...
