EUVD-2026-70130

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

CVE-2026-84659

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...

CVE-2026-84659

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...

EUVD-2026-70120

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

CVE-2026-84654

In Stapler 2107.v8dfcb_e8ed317 and earlier (except 2088.2093.vd7c3e58008a_6 ), which are included in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier), a form data binding vulnerability exists. This flaw allows an attacker capable of submitting configuration forms to modify public static fields...

CVE-2026-84654

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

CVE-2026-84654

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

CVE-2025-15490 Passster < 4.2.26 - Global Protection Bypass

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...

CVE-2025-15490

Passster WordPress plugin versions before 4.2.26 contain a flaw in its global protection checks , enabling unauthenticated users to bypass the plugin's protection mechanism via crafted URLs. The impact is rated Medium (CVSS 5.3) with a low confidentiality impact and no integrity or availability i...

EUVD-2025-210832

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...

CVE-2025-15490 Passster < 4.2.26 - Global Protection Bypass

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...

PT-2026-84713

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...

PT-2026-84787

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

Form submission data binding can set static fields

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of...

PT-2026-84782

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1412.v7737b 3405f86 Description An issue exists where a permission check is not enforced in the method controlling the "Force the use of the sandbox globally in the system" setting. This allows...

CVE-2026-84654: External Control of Assumed-Immutable Web Parameter

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

PT-2026-84777

In Stapler 2107.v8dfcb e8ed317 and earlier, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify...

PT-2026-84853

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A malicious peer can send crafted messages after a channel has been established to cause a deadlock of the entire connection. This occurs because the system...

gpac:fuzz_probe_analyze: Global-buffer-overflow in gf_ac4_substream_group_info

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=6063460539236352 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzprobeanalyze Job Type: aflasangpac Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x5a4f0433c67c Crash Stat...

Palo Alto GlobalProtect App 6.0.x < 6.0.15 / 6.2.x < 6.2.8-h13 / 6.3.x < 6.3.3-h14 Multiple Vulnerabilities (Global Un-Protect)

The version of Palo Alto GlobalProtect App installed on the remote Windows host is 6.0.x prior to 6.0.15, 6.2.x prior to 6.2.8-h13, or 6.3.x prior to 6.3.3-h14. It is, therefore, affected by multiple vulnerabilities collectively known as Global Un-Protect: - Local privilege escalation...