118800 matches found
CVE-2026-42525
Jenkins Microsoft Entra ID previously Azure AD Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...
EUVD-2026-26225
Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting XSS vulnerability exploitable by non-anonymous attackers with...
CVE-2026-42523
Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting XSS vulnerability exploitable by non-anonymous attackers with...
CVE-2026-42524
Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
CVE-2026-42524
The Jenkins HTML Publisher Plugin (versions 427 and earlier) is vulnerable to a stored cross-site scripting (XSS) attack because it fails to escape the job name and URL within the legacy wrapper file. Attackers with Item/Configure permissions can exploit this to execute malicious scripts. To reme...
CVE-2026-42522
A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdead580c1aba and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials...
CVE-2026-42522
The Jenkins GitHub Branch Source Plugin (versions 1967.vdea_d580c1a_b_a_ and earlier) contains a missing permission check in a method implementing form validation. This flaw allows attackers with Overall/Read permission to perform a connection test to an attacker-specified URL using attacker-spec...
CVE-2026-42517
creationtimestamp| type| source ---|---|--- 2026-04-29 10:58:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkmwxaeoss2h...
CVE-2026-42518
creationtimestamp| type| source ---|---|--- 2026-04-29 10:53:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkmwobxnns2p...
CVE-2026-42515
This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit this vulnerability by manipulating parameter in the API request URL to gain unauthorized access to sensitive information of patients on the targeted system...
CVE-2026-42516
This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. An authenticated attacker could exploit this vulnerability by manipulating encoded parameters in the request URL to gain unauthorized access to patient accounts on the targeted system...
EUVD-2026-26203
This vulnerability exists in e-Sushrut due to the use of reversible Base64 encoding for protecting sensitive data. An authenticated attacker could exploit this vulnerability by decoding and manipulating Base64-encoded parameters in the request URL to gain unauthorized access to sensitive...
CVE-2026-42517
This vulnerability exists in e-Sushrut due to the use of reversible Base64 encoding for protecting sensitive data. An authenticated attacker could exploit this vulnerability by decoding and manipulating Base64-encoded parameters in the request URL to gain unauthorized access to sensitive...
EUVD-2026-26201
This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. An authenticated attacker could exploit this vulnerability by manipulating encoded parameters in the request URL to gain unauthorized access to patient accounts on the targeted system...
Malicious code in apple-internal-pki-trust (npm)
Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Apple internal infrastructure services authentication, PKI, telemetry, CloudKit, and cloud infrastructure. All packages in this campaign execute credential-theft payloads durin...
CLSA-2026-1777446306 python: Fix of CVE-2019-9948
CVE-2019-9948: fix urllib localfile:// URL scheme bypass that allowed file reads when localfile handler was defined...
CLSA-2026-1777445847 grafana-pcp: Fix of CVE-2026-25679
Rebuild against recent Go compiler - CVE-2026-25679: fix net/url insufficient validation of host in url.Parse...
CVE-2026-5773
creationtimestamp| type| source ---|---|--- 2026-04-29 06:55:58+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mkmjfk3qfp2u 2026-04-29 12:45:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkn4vufiap2k 2026-05-13 12:37:06+00:00| seen|...
CVE-2026-4873
creationtimestamp| type| source ---|---|--- 2026-04-29 06:51:40+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mkmj5tu7cu2x 2026-04-29 12:45:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkn4vufiap2k...