CVE-2026-84660

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds triggered by the build step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job...

CVE-2026-84660

Jenkins Pipeline: Build Step Plugin (pipeline-build-step) 599.v4b_67ea_11b_152 and earlier contains a missing permission check that allows downstream builds to be canceled even when the triggering build's authentication lacks Item/Cancel permission on the downstream job. The issue is triggered wh...

CVE-2026-84659

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...

EUVD-2026-70125

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...

CVE-2026-84659

Jenkins Script Security Plugin versions 1412.v7737b_3405f86 and earlier are affected by an improper access control vulnerability. A @DataBoundSetter annotated method controlling the "Force the use of the sandbox globally in the system" setting does not enforce a permission check, allowing an auth...

EUVD-2026-70122

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

CVE-2026-84656

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

CVE-2026-84656

A missing Item/Read permission check in an HTTP endpoint of Jenkins 2.579 and earlier (and LTS 2.568.2 and earlier ) allows an attacker with Item/Read permission on at least one job to read build parameter names and values of other jobs they should not have access to. This is tracked as SECURITY-...

EUVD-2026-68887

Sulu: Fix authorization bypass when creating preview links...

Sulu: Fix authorization bypass when creating preview links

Impact A missing authorization check on the preview link endpoint lets a backend user create a public, unauthenticated preview URL for content they are not allowed to see. PreviewLinkController and the underlying PreviewLinkManager::generate / revoke never enforced a permission on the target...

velociraptor_CVE-2025-6264_PoC

CVE-2025-6264 DISCLAIMER: This is an educational research project. I did not discover this vulnerability. This repository demonstrates CVE-2025-6264 for learning purposes Affected versions before 0.74.3 Affects Windows, MacOS and Linux The Admin.Client.UpdateClientConfig artifact is missing...

CVE-2026-84805

Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/id/preferences endpoint. Although the web interface gates these employment-contract fields behind the contractotherprofile admin permission, the...

CVE-2026-84798

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...

EUVD-2026-69917

Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/id/preferences endpoint. Although the web interface gates these employment-contract fields behind the contractotherprofile admin permission, the...

CVE-2026-84804 Kimai before 2.65.0 Authorization Bypass via Team Activity API

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with editteam permission can revoke team access without the required permissionsactivity check, bypassing authorization controls...

PT-2026-84780

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

PT-2026-84779

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

PUB-A-508704568

In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-508716504

In VPU, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

ASB-A-459460951

In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...