EUVD-2026-70217

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a...

CVE-2026-84661

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds awaited by the waitForBuild step when the propagateAbort parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream jo...

CVE-2026-84663

A cross-site request forgery CSRF vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches...

CVE-2026-84661

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds awaited by the waitForBuild step when the propagateAbort parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream jo...

my-dshrness-aipentest

DSH PenTest Workflow v4.2 A multi-agent penetration testing w...

CVE-2026-84660: Missing Authorization

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds triggered by the build step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job...

CVE-2026-84663: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches...

CVE-2026-84661: Missing Authorization

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds awaited by the waitForBuild step when the propagateAbort parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream jo...

PT-2026-84784

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b 67ea 11b 152 and earlier causes downstream builds awaited by the waitForBuild step when the propagateAbort parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream...

Missing permission check in pipeline-build-step allows canceling downstream builds

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. By default, builds run as SYSTEM and are unconstrained unless plugins implement specific additional permission checks. Plugins like Authorize Projec...

CSRF vulnerability in pipeline-groovy-lib

pipeline-groovy-lib 798.v5cc688825312 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to delete shared library caches. pipeline-groovy-lib 805.vafc79344957d requires POST requests fo...

CVE-2026-84372

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write by splitting it with...

CVE-2026-84372 Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write by splitting it with...

CVE-2026-84372 Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write by splitting it with...

CVE-2026-84372

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write by splitting it with...

CVE-2026-83551

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

CVE-2026-83551

Amazon SageMaker Python SDK versions prior to v3.11.0 and v2.256.0 store the HMAC signing key in cleartext within the @step and @remote decorator pipeline component. This allows an authenticated remote user to extract the key from SageMaker DescribePipeline API responses and forge valid integrity...

CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

EUVD-2026-69418

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...