Jenkins <=2.196 - Cookie Exposure

Jenkins through 2.196, LTS 2.176.3 and earlier prints the value of the cookie on the /whoAmI/ URL despite it being marked HttpOnly, thus making it possible to steal cookie-based authentication credentials if the URL is exposed or accessed via another cross-site scripting issue. id: CVE-2019-10405...

Agentejo Cockpit < 0.11.2 - NoSQL Injection

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. The $eq operator matches documents where the value of a field equals the specified value. id: CVE-2020-35846 info: name: Agentejo Cockpit 0.11.2 - NoSQL Injection author: dwisiswant0 severity: critic...

VMware vCenter Server LDAP Broken Access Control

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller PSC, does not correctly implement access controls. id: CVE-2020-3952 info: name: VMware vCenter Server LDAP Broken Access Control author: 0xAkoko severity: critic...

Joomla! JCK Editor SQL Injection

The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter. id: CVE-2018-17254 info: name: Joomla! JCK Editor SQL Injection author: SumanKar severity: critical description: The JCK Editor component 6.4.4 for Joomla! allows SQL Injection vi...

NextGen Healthcare Mirth Connect - Remote Code Execution

Unauthenticated remote code execution vulnerability in NextGen Healthcare Mirth Connect before version 4.4.1. id: CVE-2023-43208 info: name: NextGen Healthcare Mirth Connect - Remote Code Execution author: princechaddha severity: critical description: Unauthenticated remote code execution...

CLEANSTART-2026-VX04129 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54514 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-FQ60259 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings

Security vulnerability affects the apache-hive package. Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings...

CLEANSTART-2026-YA06862 Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack

CVE-2026-59282 affects multiple packages. Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. See references for individual vulnerability details...

CLEANSTART-2026-OX66799 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

CVE-2026-39826 affects multiple packages. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block. See references for individual...

CLEANSTART-2026-GJ18736 `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...

CVE-2026-79993 affects multiple packages. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. See references for...

CLEANSTART-2026-NN37649 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-59889 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-LY52990 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-77310 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-WQ14313 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54518 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-QO27706 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-59888 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-RR27418 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54515 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-ZG74825 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54516 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-XX16002 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54517 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-GS75454 Deserialization of untrusted data vulnerability in QOS

Security vulnerability affects the trino package. Deserialization of untrusted data vulnerability in QOS...

CLEANSTART-2026-IG09233 Deserialization of untrusted data vulnerability in QOS

Security vulnerability affects the trino package. Deserialization of untrusted data vulnerability in QOS...

CLEANSTART-2026-HP74376 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54512 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...