CVE-2026-92126

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable...

EUVD-2026-80750

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable...

CVE-2026-92126

The Jenkins Script Security Plugin (version 1415.v9a_f9b_3a_c253d and earlier) contains a sandbox bypass vulnerability. The plugin fails to reject @Builder annotations where the builderStrategy member refers to an arbitrary class. This allows an attacker with permission to define and run sandboxe...

CVE-2026-92126

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable...

CVE-2026-92126

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable...

CVE-2026-92126

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable...

CVE-2026-5920

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcodecontent' parameter of the btbbshortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter btbbsavepre that can be circumvented via null byte...

EUVD-2026-80111

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcodecontent' parameter of the btbbshortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter btbbsavepre that can be circumvented via null byte...

CVE-2026-5920

Bold Page Builder (WordPress plugin, versions up to and including 5.9.6 ) is vulnerable to Stored Cross-Site Scripting via the shortcode_content parameter of the bt_bb_shortcode shortcode. The root cause is a bypassable security filter (bt_bb_save_pre) that can be circumvented via null byte injec...

CVE-2026-5920 Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcodecontent' parameter of the btbbshortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter btbbsavepre that can be circumvented via null byte...

CVE-2026-5920 Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcodecontent' parameter of the btbbshortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter btbbsavepre that can be circumvented via null byte...

PT-2026-93273

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode content' parameter of the bt bb shortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter bt bb save pre that can be circumvented via null...

CVE-2026-12793: Improper Privilege Management

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content ...

PT-2026-94091

Name of the Vulnerable Software and Affected Versions quay-builder-qemu affected versions not specified Description A flaw exists where the release workflow uses the upstream Noelware/docker-manifest-action pinned to a mutable branch. A remote attacker could compromise this upstream action to...

Sandbox bypass vulnerability in script-security

script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Groovy's @Builder annotation generates builder code at compile time using the strategy class named by its builderStrategy member, which can be on...

CVE-2026-5920: Improper Neutralization of Input During Web Page Generation

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcodecontent' parameter of the btbbshortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter btbbsavepre that can be circumvented via null byte...

CVE-2026-92126: Use of Externally-Controlled Input to Select Classes or Code

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable...

PT-2026-93769

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description Users with permission to define and run sandboxed scripts, such as Pipelines, can execute code outside the sandbox. This occurs because the plugin fails to reje...

CVE-2026-85469: Reliance on Insufficiently Trustworthy Component

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

image-builder security update

An update is available for image-builder. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A local binary for building customized OS artifacts such as VM images a...