CVE-2026-117620

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

CVE-2026-117620

Jenkins versions 2.587 and earlier , and LTS 2.580.1 and earlier , are vulnerable to a high-severity flaw (SECURITY-4226 ) involving the **

CVE-2026-117620

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

EUVD-2026-112185

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

CVE-2026-117620: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

PT-2026-128308

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.587 Jenkins LTS versions prior to 2.580.1 Description Users with Overall/Read permission can trigger warnings within the "Manage Old Data" feature. If an administrator acts upon these crafted warnings, it allows the...

PT-2026-121488

An incorrect authorization issue exposes basic account information to unauthorized remote users in KNIME Business Hub SaaS before version 1.19.0. A workaround is not possible. The same behaviour is present in on-premise KNIME Business Hub installations but it was designed as such in order to fost...

KNIME Business Hub SaaS information disclosure vulnerability

Versions prior to KNIME Business Hub SaaS 1.19.0 contain an information disclosure vulnerability stemming from improper authorization. This vulnerability may allow unauthorized remote users to obtain basic account information...

CVE-2026-103671

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin" vulnerable to external control of assumed-immutable web parameter

Overview EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin provided by EC-CUBE CO.,LTD. contains the following vulnerability. External Control of Assumed-Immutable Web Parameter CWE-472 - CVE-2026-103671 The developer states that attacks exploiting the vulnerability has been observed. EC-CUBE...

CVE-2026-103671

A vulnerability exists in the AmazonPay Plugin for the EC-CUBE 4 series due to an external control of an assumed-immutable web parameter (CWE-472). If exploited, an attacker can redirect users to an arbitrary website during the ordering process, potentially leading to the theft of user account in...

CVE-2026-103671

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

EUVD-2026-100939

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

CVE-2026-103671

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

CVE-2026-108473

Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state o...

EUVD-2026-100759

Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state o...

CVE-2026-108473

Multiple TP-Link Kasa devices are vulnerable to an improper authentication vulnerability within the local device-management protocol. An unauthenticated adjacent-network attacker can send management instructions without proper authorization, enabling unauthorized modification of device states or ...

CVE-2026-103671: External Control of Assumed-Immutable Web Parameter

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

CVE-2026-108473: Missing Authentication for Critical Function

Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state o...

PT-2026-113553

Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state o...