EUVD-2026-36065

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, ommit d4d10006 "Expand validation to block .. in configfilename and configver for improved security" added a line in app/modules/config/config.py:462. This is tuple-membership, no...

CVE-2026-45569 Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, ommit d4d10006 "Expand validation to block .. in configfilename and configver for improved security" added a line in app/modules/config/config.py:462. This is tuple-membership, no...

com.flowdock.jenkins:jenkins-flowdock-plugin (>=1.0, <=1.0.2), net.praqma:drmemory-plugin (>=1.0, <=1.3) +8 more potentially affected by CVE-2026-53439 via org.jenkins-ci.main:jenkins-core (1.454)

org.jenkins-ci.main:jenkins-core MAVEN version 1.454 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.flowdock.jenkins:jenkins-flowdock-plugin =1.0, =1.0, =1.2, =0.5, =0.6.1 Source cves:...

com.flowdock.jenkins:jenkins-flowdock-plugin (>=1.0, <=1.0.2), net.praqma:drmemory-plugin (>=1.0, <=1.3) +8 more potentially affected by CVE-2026-53440 via org.jenkins-ci.main:jenkins-core (1.454)

org.jenkins-ci.main:jenkins-core MAVEN version 1.454 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.flowdock.jenkins:jenkins-flowdock-plugin =1.0, =1.0, =1.2, =0.5, =0.6.1 Source cves:...

com.sonyericsson.hudson.plugins.multi-slave-config-plugin:multi-slave-config-plugin (1.0.0), com.thalesgroup.dtkit:dtkit-default-tusar-jenkins (0.19) +14 more potentially affected by CVE-2026-53439 via org.jenkins-ci.main:jenkins-core (1.404)

org.jenkins-ci.main:jenkins-core MAVEN version 1.404 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.sonyericsson.hudson.plugins.multi-slave-config-plugin:multi-slave-config-plugin 1.0.0 -...

org.jenkins-ci.main:jenkins-test-harness (1.491), org.jenkins-ci.main:jenkins-war (1.491) +6 more potentially affected by CVE-2026-53439 via org.jenkins-ci.main:jenkins-core (1.491)

org.jenkins-ci.main:jenkins-core MAVEN version 1.491 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.491 - org.jenkins-ci.main:jenkins-war 1.491 -...

com.coravy.hudson.plugins.github:github (>=0.5, <=0.8), com.sonyericsson.hudson.plugins.gerrit:build-config (>=1.2.2, <=1.2.9) +34 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.400)

org.jenkins-ci.main:jenkins-core MAVEN version 1.400 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.coravy.hudson.plugins.github:github =0.5, =1.2.2, =1.2.2, =2.3.0, =1.4, =1.8, =1.10, =0.1.2...

org.jenkins-ci.main:jenkins-test-harness (1.438), org.jenkins-ci.main:jenkins-war (1.438) +6 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.438)

org.jenkins-ci.main:jenkins-core MAVEN version 1.438 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.438 - org.jenkins-ci.main:jenkins-war 1.438 -...

Jenkins: Stored XSS vulnerability in node offline cause description

Jenkins 2.483 through 2.567 both inclusive, LTS 2.492.1 through 2.555.2 both inclusive does not escape the user-provided description of a generic offline cause that could be set through the POST config.xml API, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers...

GHSA-93QH-VWRM-C5PW Jenkins: Stored XSS vulnerability in node offline cause description

Jenkins 2.483 through 2.567 both inclusive, LTS 2.492.1 through 2.555.2 both inclusive does not escape the user-provided description of a generic offline cause that could be set through the POST config.xml API, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers...

org.jenkins-ci.main:jenkins-test-harness (1.491), org.jenkins-ci.main:jenkins-war (1.491) +6 more potentially affected by CVE-2026-53438 via org.jenkins-ci.main:jenkins-core (1.491)

org.jenkins-ci.main:jenkins-core MAVEN version 1.491 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.491 - org.jenkins-ci.main:jenkins-war 1.491 -...

SUSE-SU-2026:2354-1 Security update for wicked

This update for wicked fixes the following issues: - CVE-2026-44932: Fixed indirect remote shell command injection via unsanitized DHCP options bsc1265221...

Missing Encryption of Sensitive Data

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data in the handling of config.xml submissions. An attacker can access sensitive secrets stored in plaintext by obtaining Item/Extende...

Deserialization of Untrusted Data

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the config.xml submission process. An attacker can impersonate any user and send HTTP requests on their behalf, including...

CVE-2026-53435

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled config.xml submission in a way that allows them to handle HTTP requests afterwards. This can be used to...

CVE-2026-53435

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled config.xml submission in a way that allows them to handle HTTP requests afterwards. This can be used to...

EUVD-2026-36044

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /config/versions////save interpolates the URL-path configver parameter directly into a config-version path that ends up at os.systemf"dos2unix -q cfg". configver is not run...

CVE-2026-45558 Roxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section save

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints POST /api/service/haproxy//section/ and the PUT / global / defaults variants accept a JSON option field that is not validated, not escaped, and ...

CVE-2026-45558

Roxy-WI versions 8.2.6.4 and earlier expose a vulnerability in the HAProxy config generation pathway. The HAProxy section-save endpoints (POST /api/service/haproxy//section/ and related PUT /global/defaults) accept a JSON option field that is not validated or escaped and is rendered verbatim into...

EUVD-2026-36039

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints POST /api/service/haproxy//section/ and the PUT / global / defaults variants accept a JSON option field that is not validated, not escaped, and ...