Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the REST API when submitting a job configuration, due to improper validation of the coverage results ID. An attacker can execute arbitrary JavaScript in the context of other users by providing a specially...

CVE-2026-92135

Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scriptin...

CVE-2026-92135

Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scriptin...

CVE-2026-92135

Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scriptin...

EUVD-2026-80759

Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scriptin...

CVE-2026-92135

The Jenkins Coverage Plugin (version 3.3358.v9487dde48783 and earlier) is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the failure to validate the coverage results ID when a job configuration is submitted via the REST API , allowing an attacker with Item/Configure per...

PT-2026-93778

Name of the Vulnerable Software and Affected Versions Jenkins Coverage Plugin versions 3.3358.v9487dde48783 and earlier Description Insufficient validation of the coverage results ID occurs when a job configuration is submitted via the REST API. An attacker with Item/Configure permissions can...

CVE-2026-92135: Improper Neutralization of Input During Web Page Generation

Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scriptin...

Stored XSS vulnerability in coverage

coverage uses coverage results IDs to create the links to coverage results on the Jenkins UI. coverage 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API. This allows attackers with Item/Configure permission to use...

Astra Linux – Vulnerability in phpunit

PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52, involving unsafe deserialization of code coverage data during PHPT test executions. The vulnerability resides in the cleanupForCoverage method, which...

Big Enough to Break Out: Tracking the Rising Capability of LLM Penetration-Testing Agents

Large language model LLM agents are increasingly applied to penetration testing, but we still know little about what they can do or how they fail. We compare two PentestGPT-based systems: a legacy human-in-the-loop system running the open-weight Kimi K2.5, and a newer autonomous system running...

Dark-Moon v1.4.0

DarkMoon Open-source autonomous AI penetration testing — finds, exploits and qualifies every vulnerability on your own infrastructure ⭐ Star DarkMoon · 🚀 Quick Start · 🧩 Integrations · 📊 Benchmark · 🔒 Darkmoon Pro · ▶️ Install & Run OSS · ▶️ Demo Pro DarkMoon is autonomous AI penetration testing...

clusterfuzz v2.39.2

ClusterFuzz ClusterFuzz is a scalable fuzzing infrastructure that finds security and stability issues in software. Google uses ClusterFuzz to fuzz all Google products and as the fuzzing backend for OSS-Fuzz. ClusterFuzz provides many features which help seamlessly integrate fuzzing into a softwar...

wtf v0.5.8

what the fuzz A distributed, code-coverage guided, cross-platform snapshot-based fuzzer designed for attacking user and or kernel-mode targets running on Microsoft Windows and Linux user-mode experimental!. Overview what the fuzz or wtf is a distributed, code-coverage guided, customizable,...

WuppieFuzz v1.7.1

WuppieFuzz v1.7.1 TNO developed WuppieFuzz, a coverage-guided REST API fuzzer developed on top of LibAFL, targeting a wide audience of end-users, with a strong focus on ease-of-use, explainability of the discovered flaws and modularity. WuppieFuzz supports all three settings of testing black box,...

Beyond F1: Evaluating Coverage and Failure Recovery in AI Model Security Scanners

Static scanners are increasingly used to identify executable or otherwise unsafe content in machine- learning artifacts, yet conventional evaluation metrics characterize only cases where a scanner yields a usable security judgment. We evaluate ModelScan, ModelAudit, and Fickling using a controlle...

nuclei-templates v10.4.8

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the nuclei scanner which powers the actual scanning engine. This...

gha-lab-227431b300

Kiwi TCMS - Open-Source-Testmanagement .. image:: https://img.shields.io/docker/pulls/kiwitcms/kiwi :target: https://kiwitcms.readthedocs.io/en/latest/installingdocker.html :alt: Downloads from Docker Hub .. image:: https://readthedocs.org/projects/kiwitcms/badge/?version=latest :target:...

ICS Cybersecurity Datasets: A Systematic Meta-Review of Coverage, Evaluation Practice, and Structural Gaps

Intrusion detection research in Industrial Control Systems ICS heavily depends on public datasets, yet no prior work has systematically assessed whether the collective dataset corpus supports current evaluation claims. This paper addresses this gap through a meta-review of 18 studies between 2019...

A Case-Control Measurement Study of OSINT Source Effectiveness for Critical Infrastructure Defense

Defenders of critical infrastructure CI subscribe to many public open-source intelligence OSINT feeds without an empirical basis for which feeds actually precede attacks. We provide one. Across 54 confirmed CI cyberattacks from 2010 through 2024 spanning twelve named CI sectors plus a cross-secto...