CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +8 more potentially affected by CVE-2026-70611 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70611 Source advisory: GHSA-F2R8-JV7C-XQMP...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +8 more potentially affected by CVE-2026-70611 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70611 Source advisory: MEND:CVE-2026-70611...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +8 more potentially affected by CVE-2026-70610 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70610 Source advisory: GHSA-FF2P-HMQR-HXM4...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +8 more potentially affected by CVE-2026-70610 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70610 Source advisory: MEND:CVE-2026-70610...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +8 more potentially affected by CVE-2026-70607 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70607 Source advisory: MEND:CVE-2026-70607...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability, which stems from the repeated release of the response buffer during the SMB2close function’s replay process...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +8 more potentially affected by CVE-2026-70604 via electron (>=41.0.3, <=41.3.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70604 Source advisory: GHSA-V3J7-R9GQ-3GJW...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +8 more potentially affected by CVE-2026-70604 via electron (>=41.0.3, <=41.3.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70604 Source advisory: MEND:CVE-2026-70604...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +8 more potentially affected by CVE-2026-70601 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70601 Source advisory: GHSA-H7RP-CF8H-J98X...

MAL-2026-13347 Malicious code in javas-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb8d6c5cf1104be2efdc1b3e6ff2e6dbc19f8b5036f87f6edaf99116216c0c53 javas-crypto ships a postinstall hook package.json line 11: "postinstall": "node setup.js" and a top-level autoExecute in index.js that both enumerat...

MAL-2026-13346 Malicious code in hdkey-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b36c64fed7b6d50787a971cc649c1f97605f6ea7027f388e9185ea85a580013 On module load, index.js reads the complete process.env object along with hostname, username, home directory, platform, and current working directory...

Malicious code in bigops-logs-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5a922558781f9614bc47976e2e695cc8a5996ef51865fb5b37928f842718b5d On require of bigops-logs-player, index.js loads polyfill.js, which reconstructs a list of Cloudflare Workers hostnames...

Malicious code in bigops-nitro-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfbd116994566a3e99f61697a738787d8089c2c99dbc9d5c55f9f3902a6b8cff On require, index.js loads vendor.js which downloads a platform-specific native binary from rotating Cloudflare Workers endpoints...

MAL-2026-13233 Malicious code in bigops-procedure-file-handlers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c15f49a67f4aa7071f4143a57c729f98dae58b01eb58ac77aabc666f1a1dda0 On require of the package, runtime.js downloads a platform-specific executable from obfuscated Cloudflare Workers endpoints hostnames reassembled at...

Malicious code in @zzzcrypto/xrp-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 781049b09ea0edc63ede63c8c559e3e9a08255982bbe6d18c2e4c0823b4fdf0c Package impersonates the legitimate xrpl library README: 'Drop-in replacement for xrpl'; author field 'XRPLF'; repo points to a non-existent...

Malicious code in @zzzcrypto/playwrite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c297b354235cda442a2ca4057884b85f1e29a920c6dcae318ab8149770ad80d0 On require of @zzzcrypto/playwrite, index.js harvests the installer's full process.env plus hostname, username, homedir, platform, cwd, and package...

MAL-2026-13263 Malicious code in devplatform-spa-use-track (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59ba2c5091a95bcff203618393da399071dba1859bb0af79ca39021b7a1bdb5f On require of the package, index.js loads polyfill.js which fetches a platform-specific binary from one of four Cloudflare Workers hosts...