CVE-2026-45549 Roxy-WI: Authorization bypass on POST /smon/agent/action/<action> — guest can stop or restart smon-agent on any host

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, agentaction app/routes/smon/agentroutes.py:166-179 has decorators @bp.post'/agent/action/' and @jwtrequired only — no role check, no group ownership check on the serverip form...

CVE-2026-49740

creationtimestamp| type| source ---|---|--- 2026-06-10 13:15:35+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnws6y5lau2n...

CVE-2026-47351

creationtimestamp| type| source ---|---|--- 2026-06-10 13:15:35+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnws6y5lau2n...

CVE-2026-47352

creationtimestamp| type| source ---|---|--- 2026-06-10 13:15:35+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnws6y5lau2n...

CVE-2026-47350

creationtimestamp| type| source ---|---|--- 2026-06-10 13:15:34+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnws6y5lau2n...

CVE-2026-49938

creationtimestamp| type| source ---|---|--- 2026-06-10 13:15:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnws6ecbbi2y...

CVE-2026-53442

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to t...

CVE-2026-53442

CVE-2026-53442 affects Jenkins 2.567 and earlier, LTS 2.555.2 and earlier. The issue: secrets posted via config.xml are not encrypted before being stored in job config.xml files on the Jenkins controller, allowing disclosure to users with Item/Extended Read permissions or filesystem access. This ...

CVE-2026-53442

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to t...

EUVD-2026-36026

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to t...

CVE-2026-53441

Summary: CVE-2026-53441 affects Jenkins core 2.483–2.567 and LTS 2.492.1–2.555.2, where the description field for an offline cause can be stored via the POST config.xml API, enabling stored XSS. This requires attacker permission at Agent/Configure level. What’s known from provided sources: The vu...

CVE-2026-53440

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain...

CVE-2026-8853

creationtimestamp| type| source ---|---|--- 2026-06-10 11:36:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnwmo3qbcp27 2026-06-10 21:16:45+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mnxn3fbuoc2o 2026-06-11 02:23:34+00:00| seen|...

CVE-2026-9019

creationtimestamp| type| source ---|---|--- 2026-06-10 11:31:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnwmf5ckts2r 2026-06-10 18:04:38+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mnxcdurote2a...

GHSA-P58X-R3C9-X9P6

creationtimestamp| type| source ---|---|--- 2026-06-10 11:30:53+00:00| seen| https://bsky.app/profile/hnbot.gsuscs.xyz/post/3mnwmdrqrxc2q 2026-06-10 12:04:33+00:00| seen| https://bsky.app/profile/betterhn20.e-work.xyz/post/3mnwo7xvt7d2u 2026-06-11 01:43:14+00:00| seen|...

CVE-2026-8613

creationtimestamp| type| source ---|---|--- 2026-06-10 11:26:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnwm46rmfh2v 2026-06-11 02:54:23+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mny7x5cvs52w...

CVE-2026-11852

creationtimestamp| type| source ---|---|--- 2026-06-10 11:00:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnwkmx4jsw2r...

CVE-2026-9060

creationtimestamp| type| source ---|---|--- 2026-06-10 10:57:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnwkhks5y62p...

CVE-2026-10846

creationtimestamp| type| source ---|---|--- 2026-06-10 09:21:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnwf53vrkt2m 2026-06-10 13:22:16+00:00| seen| https://social.nlnetlabs.nl/users/nlnetlabs/statuses/116726018811865481 2026-06-19 18:17:15+00:00| seen|...

CVE-2026-47906

creationtimestamp| type| source ---|---|--- 2026-06-10 09:06:07+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mnweavss3g27 2026-06-12 00:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mo2h2xtdbn2o...