1351 matches found
BIT-JENKINS-2026-70430
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...
PT-2026-73346
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...
CVE-2026-70430
A flaw was found in Jenkins. This vulnerability allows an attacker with Overall/Manage permission to instantiate arbitrary types of objects within the project naming strategy configuration. This includes types typically reserved for administrators, potentially leading to unauthorized configuratio...
CVE-2026-70430
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...
EUVD-2026-53524
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...
CVE-2026-70430
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...
Users with Overall/Manage permission can instantiate any types related to configuration
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration. This allows attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...
EUVD-2026-51807
ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...
CVE-2026-67344
ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...
CVE-2026-67344 ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE
ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...
CVE-2026-67344 ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE
ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...
CVE-2026-67344
ArcadeDB before 26.7.2 is affected: ALTER TYPE operations for CUSTOM and BUCKETSELECTIONSTRATEGY do not enforce UPDATE_SCHEMA, allowing an authenticated user with only read access (e.g., a read‑only API token) to mutate a type’s custom schema metadata and bucket‑selection strategy via the HTTP co...
Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents
Large Language Model LLM-driven multimodal agents are increasingly deployed to execute autonomous tasks via continuous audio interaction. While this paradigm enhances interaction naturalness, it introduces a critical yet under-explored attack surface, as audio inputs inevitably contain...
CVE-2026-59888
A flaw was found in jackson-databind. When Java Records use a PropertyNamingStrategy, an attacker can bypass the @JsonIgnore annotation during deserialization. This allows a renamed JSON key to be assigned to a Record constructor parameter, even if it was intended to be ignored. Consequently, an...
SUSE-SU-2026:22954-1 Security update for alloy
This update for alloy fixes the following issue: Update to version 1.17.1. Security issue fixed: - CVE-2026-10722: github.com/cilium/ebpf: interger overflow when performing BTF string offset boundary check can lead to crash when malformed ELF/BTF input is parsed bsc1267811. Other updates and...
GHSA-3PJW-73GF-8QR5 jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
Summary For Java Records, POJOPropertiesCollector.removeUnwantedIgnorals records a @JsonIgnore-annotated component under its original implicit name before renameUsing applies the PropertyNamingStrategy. After the rename, ignoredPropertyNames still holds only the pre-rename name, so ignorableProps...
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
Summary For Java Records, POJOPropertiesCollector.removeUnwantedIgnorals records a @JsonIgnore-annotated component under its original implicit name before renameUsing applies the PropertyNamingStrategy. After the rename, ignoredPropertyNames still holds only the pre-rename name, so ignorableProps...
EUVD-2026-43957
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy...
CVE-2026-16073
A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function Star.texttoimage/NetworkRenderStrategy.render of the file astrbot/core/star/base.py of the component T2I Feature. The manipulation leads to cross site scripting. The attack is...