CVE-2026-84658

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...

EUVD-2026-70124

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...

CVE-2026-84658

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...

CVE-2026-84659

The Jenkins Script Security Plugin (version 1412.v7737b_3405f86 and earlier) fails to enforce a permission check in the method governing the "Force the use of the sandbox globally in the system" setting. This allows attackers to disable the global sandbox via Stapler data binding . To remediate t...

CVE-2026-84658

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...

CVE-2026-84659

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), au.com.versent.jenkins.plugins:ignore-committer-strategy (>=29.v7c3891a_434c3, <=63.v7e87d06b_a_30c) +424 more potentially affected by CVE-2026-84658 via org.jenkins-ci.plugins:script-security (>=1.4, <=1412.v7737b_3405f86)

org.jenkins-ci.plugins:script-security MAVEN version =1.4, =29.v7c3891a434c3, =2.33.0, =4.1.0.506.v619d63bec9d8, =1.0.5.0, =0.2, =198.vfe106798d1a6, =66.v12c841920f7d, =1.9.2-beta, =1.151.vbca71ddd0bcf, =1.29, =1.28.0, =61.v68bd7264b643, =73.ve2b957fc2921 and more Source cves: CVE-2026-84658 Sour...

CVE-2026-84659

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...

EUVD-2026-70125

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...

CVE-2026-84658

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...

CVE-2026-84658

The Jenkins Script Security Plugin (versions 1412.v7737b_3405f86 and earlier) contains a vulnerability where a constructor used to load script approval configuration is incorrectly annotated with @DataBoundConstructor . This oversight in the Stapler web framework's data-binding mechanism allows a...

CVE-2026-84659

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...

CVE-2026-84659: Missing Authorization

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...

CVE-2026-84658: Exposure of Sensitive Information to an Unauthorized Actor

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...

PT-2026-84781

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1412.v7737b 3405f86 Description The software uses the @DataBoundConstructor annotation on a constructor responsible for loading script approval configuration. This allows attackers who can submi...

PT-2026-84782

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1412.v7737b 3405f86 Description An issue exists where a permission check is not enforced in the method controlling the "Force the use of the sandbox globally in the system" setting. This allows...

Improper access control in script-security

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties...

CVE-2026-70431

Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM...

CVE-2026-70431

Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM...

CVE-2026-70431

The Jenkins Multijob Plugin versions 669.v9d96a_d9c71b_0 and earlier are vulnerable to arbitrary code execution. The root cause is that the plugin provides Groovy scripting features that do not integrate with the Script Security Plugin , failing to enforce necessary sandboxing. An attacker posses...