CVE-2026-92140

Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint...

CVE-2026-92140: Improper Neutralization of Input During Web Page Generation

Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint...

PT-2026-93783

Name of the Vulnerable Software and Affected Versions Jenkins Gitee Plugin versions prior to 1301.v8957053c7902 Description Stored cross-site scripting XSS occurs because the plugin fails to escape the sender name within Gitee push webhook payloads in build causes. This allows attackers who can...

Stored XSS vulnerability in gitee

gitee 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds via the gitee webhook endpoint. gitee 1304.v2702f1d71cde escapes t...

CISA: CISA Vulnerability Review Fiscal Years 2024 and 2025

The CISA Vulnerability Review provides organizations with critical insights into the root causes of insecure software and practical steps they can take to address these flaws to prevent exploitation. Analyzing CISA and open source data from fiscal years 2024 and 2025, the review establishes a...

CVE-2026-12706

A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decodemove function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by...

EUVD-2026-35989

A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially crafted packet, triggering an exception that causes the system to reboot unexpectedly, resulting in a denial of service...

EUVD-2026-35907

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

CVE-2026-41730 Spring Data REST exposes persistence-layer internals in error responses

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

CVE-2026-41730 Spring Data REST exposes persistence-layer internals in error responses

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

CVE-2026-41730

Spring Data REST is the affected component. The CVE describes that it serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence‑layer internals to HTTP clients. Affected versions include Spring Data REST 3.7.0–3.7.19; 4.3.0–4.3.16; 4.4.0–4.4.14; 4...

WebCodecs Component DoS

The vulnerability of the WebCodecs component in the Google Chrome web browser relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure through a specially created HTML page...

CVE-2026-28527

BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Controller GETPLAYERAPPLICATIONSETTINGATTRIBUTETEXT and GETPLAYERAPPLICATIONSETTINGVALUETEXT handlers that allows nearby attackers to read beyond packet boundaries. Attackers can establish a paire...

ASB-A-483074618

In multiple locations, there is a possible way to access unexpected data due to multiple causes. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Data Breaches in 2026: What’s old, what’s new?

Data breaches in 2026 explained, new cyber threats, AI driven attacks, common breach causes, and practical security strategies for individuals and businesses...

Fixing the script: Journey to reduce XSS exposure

Cross‑site scripting XSS remains one of the most frequently reported web vulnerabilities—not because developers are unaware of it, but because many deployed mitigations address symptoms rather than root causes. Across vulnerability reports and incident response investigations, both within Microso...

SmartSoft SmartFTP Client security vulnerabilities

SmartSoft SmartFTP Client is a file transfer software client developed by SmartSoft Corporation. Version 10.0.2909.0 of SmartSoft SmartFTP Client contains security vulnerabilities. These vulnerabilities stem from multiple denial-of-service vulnerabilities, which may lead to the application crashi...

Celestial AbsoluteTelnet Buffer Error Vulnerability

Celestial AbsoluteTelnet is a Telnet/SSH terminal client software developed by the American company Celestial. Version 11.24 of Celestial AbsoluteTelnet contains a buffer error vulnerability. This vulnerability stems from manipulating the username and error report fields, which could allow local...

CVE-2023-43502

A cross-site request forgery CSRF vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes...

SecTracer: A Framework for Uncovering the Root Causes of Network Intrusions Via Security Provenance

Modern enterprise networks comprise diverse and heterogeneous systems that support a wide range of services, making it challenging for administrators to track and analyze sophisticated attacks such as advanced persistent threats APTs, which often exploit multiple vectors. To address this challeng...