Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in . If SharedIteratorCache and ListObjectsIteratorCache are enabled, a user can influence authorization decisions by sending malicious requests that trigger cache key collisions, causing t...

keycloak: Keycloak: Unauthorized account access via replayed refresh tokens after cluster restart

A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refresh token, to replay that token even after it has been...

CVE-2026-46612 Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, the Fission storagesvc component registers archive CRUD handlers /v1/archive GET / POST / DELETE and /v1/archives list directly on...

EUVD-2026-36091

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, the Fission storagesvc component registers archive CRUD handlers /v1/archive GET / POST / DELETE and /v1/archives list directly on...

org.jenkins-ci.main:jenkins-test-harness (1.619), org.jenkins-ci.main:jenkins-war (1.619) +4 more potentially affected by CVE-2026-53438 via org.jenkins-ci.main:jenkins-core (1.619)

org.jenkins-ci.main:jenkins-core MAVEN version 1.619 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.619 - org.jenkins-ci.main:jenkins-war 1.619 -...

org.jenkins-ci.main:jenkins-test-harness (1.619), org.jenkins-ci.main:jenkins-war (1.619) +4 more potentially affected by CVE-2026-53439 via org.jenkins-ci.main:jenkins-core (1.619)

org.jenkins-ci.main:jenkins-core MAVEN version 1.619 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.619 - org.jenkins-ci.main:jenkins-war 1.619 -...

org.jenkins-ci.main:jenkins-test-harness (1.619), org.jenkins-ci.main:jenkins-war (1.619) +4 more potentially affected by CVE-2026-53442 via org.jenkins-ci.main:jenkins-core (1.619)

org.jenkins-ci.main:jenkins-core MAVEN version 1.619 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.619 - org.jenkins-ci.main:jenkins-war 1.619 -...

org.jenkins-ci.main:jenkins-test-harness (1.619), org.jenkins-ci.main:jenkins-war (1.619) +4 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.619)

org.jenkins-ci.main:jenkins-core MAVEN version 1.619 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.619 - org.jenkins-ci.main:jenkins-war 1.619 -...

org.jenkins-ci.main:jenkins-war (1.645), org.jenkins-ci.main:test (1.645) +5 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.645)

org.jenkins-ci.main:jenkins-core MAVEN version 1.645 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-war 1.645 - org.jenkins-ci.main:test 1.645 -...

org.jenkins-ci.main:jenkins-war (1.645), org.jenkins-ci.main:test (1.645) +5 more potentially affected by CVE-2026-53440 via org.jenkins-ci.main:jenkins-core (1.645)

org.jenkins-ci.main:jenkins-core MAVEN version 1.645 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-war 1.645 - org.jenkins-ci.main:test 1.645 -...

org.jenkins-ci.main:jenkins-test-harness (1.619), org.jenkins-ci.main:jenkins-war (1.619) +4 more potentially affected by CVE-2026-53437 via org.jenkins-ci.main:jenkins-core (1.619)

org.jenkins-ci.main:jenkins-core MAVEN version 1.619 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.619 - org.jenkins-ci.main:jenkins-war 1.619 -...

GHSA-M6WV-WH8G-64XC Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to t...

CVE-2026-49742

Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer FAL via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. This...

EUVD-2026-36034

A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the /api/v1/sources/id/image-url endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance OVA images...

CVE-2026-53470

CVE-2026-53470 affects migration-planner. An authenticated attacker can exploit an improper access control on /api/v1/sources/{id}/image-url to bypass ownership checks and obtain presigned S3 URLs for other users’ Open Virtual Appliance (OVA) images, potentially downloading images containing long...

Access Control Bypass

Overview @hulumi/policies is a Pulumi CrossGuard policy packs for AWS, GitHub, Kubernetes, Cloudflare, and deployment governance. Includes HulumiHardeningPack, HulumiAwsOrgHardeningPack, state/backend/primitive/detection rules, GitHub packs, EKS packs, and platform governance. SLSA Bui Affected...

CVE-2026-53442

Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier ) are vulnerable to a flaw where secrets submitted via POST config.xml are stored unencrypted in job configuration files on the Jenkins controller. This occurs because submissions are written to disk as-is once successfully deserialized....

CVE-2026-9185

The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.22.0 via the userId parameter of the sixstoragegetuserinfo and sixstorageupdateprofile AJAX actions. This is due to the sixstoragegetUserInfo and...

CVE-2026-9019

The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gridpropertiesborderColor' and 'gridimagesNattachmenturl' Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-35993

The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gridpropertiesborderColor' and 'gridimagesNattachmenturl' Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping. This makes it possible for...