CLEANSTART-2026-RS34156 Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

CLEANSTART-2026-KU24747 Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack

Security vulnerability affects the apache-hive package. Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack...

CLEANSTART-2026-RI59147 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the sonarqube package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-QT94444 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-77310 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-FF14094 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the sonarqube package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-KU83313 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the sonarqube package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-ES07663 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the sonarqube package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CVE-2026-59281

A flaw was found in Spring MVC and WebFlux applications. When these applications are configured to obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors, they become vulnerable...

jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified

A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly...

jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified

A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly...

jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified

A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly...

CVE-2026-59282

A flaw was found in Spring Framework. Applications utilizing Spring's data binding infrastructure to apply user-supplied property paths onto a target object are susceptible to a Denial of Service DoS attack. A remote attacker could exploit this by providing specially crafted input, leading to...

jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified

A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly...

BIT-JENKINS-2026-84654

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

BIT-JENKINS-2026-84647

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

PT-2026-88164

In Stapler 2107.v8dfcb e8ed317 and earlier, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

PT-2026-88171

In Stapler 2107.v8dfcb e8ed317 and earlier, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify...

CVE-2026-84647

A flaw was found in Stapler, a web framework included in Jenkins. This vulnerability allows an attacker with 'Overall/Read' permission to instantiate objects related to configuration through form data binding. The system does not properly restrict the types of objects that can be created, enablin...

CVE-2026-84664

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

CVE-2026-84667

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups...