CVE-2026-82561: Missing Authorization

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was...

PT-2026-93771

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description The plugin downloads a JAR file from a specified URL twice. It confirms the approval of the first download but loads the classpath entries from the second. This...

PT-2026-93770

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description An issue exists where classpath entries in an item configuration are automatically approved when a user with Overall/Administer permission copies the item or...

PT-2026-93766

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description Attackers with permission to define and run sandboxed scripts, including Pipelines, can bypass sandbox protection to execute arbitrary code in the context of th...

PT-2026-93774

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Groovy Libraries Plugin versions prior to 805.va fc79344957d Description An issue exists where the library path provided to the library Pipeline step is not restricted to a relative path within the SCM checkout. Additionally,...

PT-2026-93765

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1415.v9a f9b 3a c253d and earlier Description An issue exists where the plugin fails to verify the method called through a proxy created when a sandboxed script coerces a value to an interface. If the...

CVE-2026-92124: Protection Mechanism Failure

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast on the collection itself, allowing attackers with permission to define and run...

PT-2026-93767

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description An issue exists where the plugin incorrectly validates operations performed by Groovy when a sandboxed script casts a collection to another type. Because the ca...

PT-2026-93818

Name of the Vulnerable Software and Affected Versions PbootCMS versions prior to 3.2.25 Description A cross-site request forgery issue exists in the User Management component. A remote attacker can manipulate the UserController::del and UserController::mod functions within the...

CVE-2026-78225

A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard...

CVE-2026-78225 Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key

A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard...

CVE-2026-78225

Wärtsilä FOS-Onboard contains a hardcoded cryptographic server key in the deployer-ng Update Controller component. This allows an attacker with network access and high complexity to achieve full compromise of confidentiality, integrity, and availability on both the vulnerable and subsequent syste...

CVE-2026-78225 Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key

A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard...

CVE-2026-83253

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the...

CVE-2026-83239

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the...

EUVD-2026-79605

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the...

CVE-2026-83253

CVE-2026-83253 affects the Endeca Application Controller component within Oracle Commerce Guided Search / Oracle Commerce Experience Manager (version 11.4.0 ). This easily exploitable vulnerability allows an unauthenticated attacker with local access to the infrastructure where the product execut...

EUVD-2026-79591

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the...

CVE-2026-83239

Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller ) version 11.4.0 is affected by a local vulnerability that can lead to full takeover of the product. The attack vector is local with high complexity and requires a low-privileged account w...

CVE-2026-81924

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery CSRF in the theme page-template activation feature. The Dashboard theme Inspect controller's activatefiles action created PageTemplate records from attacker-supplied pageTemplates values without validating an anti-CSRF token.A...