Authorization Bypass Through User-Controlled Key

Overview apache-airflow-providers-microsoft-azure is a Provider package apache-airflow-providers-microsoft-azure for Apache Airflow Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the getconnvalue and getvariable paths in...

io.jenkins.plugins:artifactory-artifact-manager (>=318.v89d9642e6690, <=320.v6d1b_a_84b_16db), org.csanchez.jenkins.plugins:kubernetes (>=4467.vf26561292824, <=4560.vc25b_83890c34) +1 more potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (719.v80e905ef14eb)

org.jenkins-ci.plugins:credentials-binding MAVEN version 719.v80e905ef14eb is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.plugins:artifactory-artifact-manager...

io.jenkins.plugins:artifactory-artifact-manager (>=318.v89d9642e6690, <=320.v6d1b_a_84b_16db), org.csanchez.jenkins.plugins:kubernetes (>=4467.vf26561292824, <=4560.vc25b_83890c34) +1 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (719.v80e905ef14eb)

org.jenkins-ci.plugins:credentials-binding MAVEN version 719.v80e905ef14eb is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.plugins:artifactory-artifact-manager...

io.jenkins.docker:docker-plugin (1336.v3711dec712de), io.jenkins.plugins:docker-slaves (259.v43582a_63e8b_9) +4 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (717.v951d49b_5f3a_a)

org.jenkins-ci.plugins:credentials-binding MAVEN version 717.v951d49b5f3aa is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.docker:docker-plugin 1336.v3711dec712de -...

Malicious code in azure-keyvault-keys-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3de0c04b9047a448fde22ce214893b20493e320d70c968f9f15732f471604e35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-keyvault-keys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 660172679fceb48d3856a6f9ac67e02a6917f304c430020232753ee280ed7d64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-keyvault-keys-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware afa5074021db522183866468078973781a708a7fb9d98da60c8ac3b37a7312bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1349 Malicious code in azure-keyvault-keys-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware afa5074021db522183866468078973781a708a7fb9d98da60c8ac3b37a7312bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1345 Malicious code in azure-keyvault-certificates-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95f4c241905d9e557472c20ba2fce0d7a9246b1fd912f2b680a906e98699f866 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-keyvault-secrets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be944ac1c65267da56d78a4f4ffb7b8561cc85353d589c7df16f6ebfbcb5e568 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-keyvault-certificates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf46a9acf272f8e1a3fae7857b3808f0e8b28748ad3ddc58ef42ff1286ed07e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-keyvault-certificates-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d4a4dd27ca78c3baf11188004219aee2dde382de300b316e2276af5c2613b81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-keyvault-secrets-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e42b406b432ef2a203d09a5021bfb45c41a0d1af43c7f4436d87956264f7706 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-keyvault-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d1f7e7cdd031fdf8f2a884815a2c9ba65632e83b7ab2018761a0a9c448c331a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-keyvault-secrets-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 443a37add60cd6a3bd78fb9c4c91e1b5d9d836a32e0fcef0bc7e556dc6e15d4a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-keyvault-admin-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75f9fc7c022ef300d02bd184ffb71a0a0502d64d13bb5df78992a2af90d740cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1343 Malicious code in azure-keyvault-admin-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c6895fa55849501987a9fd8669e21d952f6d1e7aa884e5184c0d6858d12dd33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-keyvault-admin-samples-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 215e23552e6095820cfa036b763ecb49c1e8ca9cb190d9e93b735a24f96828e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1342 Malicious code in azure-keyvault-admin-samples-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 215e23552e6095820cfa036b763ecb49c1e8ca9cb190d9e93b735a24f96828e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Missing permission checks in azure-keyvault allow enumerating credentials IDs

azure-keyvault 2.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...