PT-2026-51812

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system...

Builds executed on the Jenkins controller by zapper can lead to RCE

zapper 1.0.7 and earlier does not support distributed builds, causing the file operations and build process of its "Automatically build ZAP" feature to be performed on the Jenkins controller rather than on the agent the build is assigned to. This allows attackers with Item/Configure permission to...

Passwords stored in plain text by fitnesse

fitnesse 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory, the...

CVE-2026-57302: Plaintext Storage of a Password

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system...

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization due to insufficient permission checks in the store method of the UsersController. An attacker can assign full administrative privileges to a newly...

Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the BulkAssetsController::update process. An attacker can gain unauthorized access to assets belonging to other companies...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

GHSA-VJHF-6XFR-5P9G vulnerabilities

Vulnerabilities for packages: virt-operator, virt-launcher, virt-controller-fips, harvester, virt-operator-fips, harvester-fips...

CVE-2025-14525 vulnerabilities

Vulnerabilities for packages: virt-launcher, virt-controller-fips, harvester, virt-operator-fips, docker-machine-driver-harvester, harvester-fips, virt-handler...

CVE-2024-33394 vulnerabilities

Vulnerabilities for packages: virt-operator, virt-launcher, virt-controller-fips, harvester, virt-operator-fips, harvester-fips...

GHSA-4Q63-MR2M-57HF vulnerabilities

Vulnerabilities for packages: virt-operator, virt-launcher, virt-controller-fips, harvester, virt-operator-fips, harvester-fips...

GHSA-25MH-HP8X-CGRV vulnerabilities

Vulnerabilities for packages: virt-launcher, virt-controller-fips, harvester, virt-operator-fips, docker-machine-driver-harvester, harvester-fips, virt-handler...

CVE-2024-31420 vulnerabilities

Vulnerabilities for packages: virt-operator, virt-launcher, virt-controller-fips, harvester, virt-operator-fips, harvester-fips...

GHSA-RJFV-PJVX-MJGV vulnerabilities

Vulnerabilities for packages: aws-load-balancer-controller-fips, aws-load-balancer-controller...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: migrate, crossplane-provider-aws-cloudwatch-fips, k8s-image-swapper, knative-net-istio-fips, falcoctl, falcosidekick-fips, kubeflow-pipelines-fips, neuvector-fips, gitlab-runner-fips, perses, azuredisk-csi-fips, cloud-provider-azure-fips,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: migrate, crossplane-provider-aws-cloudwatch-fips, k8s-image-swapper, knative-net-istio-fips, falcoctl, falcosidekick-fips, kubeflow-pipelines-fips, neuvector-fips, gitlab-runner-fips, perses, azuredisk-csi-fips, cloud-provider-azure-fips,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: neuvector-fips, zarf-fips, chartmuseum-fips, falco-no-driver, helm-push, grype, google-osconfig-agent, chartmuseum, manifest-tool, kubescape, kubescape-server, headlamp-fips, skaffold, k3s, scorecard, chainctl, tigera-operator, docker-compose, kargo, eksctl, kubevela...

Stored-XSS-via-Role-Attributes

Ziti Admin Console — Security Report Store...

Malicious Package

Overview carousel-controller-mixin is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malware in carousel-controller-mixin

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...