751 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-85979
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitra...
CVE-2026-85979
Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...
CVE-2026-85979
Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...
UBUNTU-CVE-2026-85979
Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...
EUVD-2026-76124
Affected versions of Puppet Enterprise contain a command injection vulnerability in the handling of the javakeystorepasswd parameter. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is...
CVE-2026-85979 Command Injection in Puppet Enterprise
Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...
CVE-2026-85979
Puppet Enterprise is affected by a command injection vulnerability in the handling of the java_keystore_passwd parameter. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by supplying a specially crafted value for this parameter, which is passed to a...
CVE-2026-85979
Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...
CVE-2026-85979 Command Injection in Puppet Enterprise
Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...
PT-2026-89884
Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions 2023.8.0 through 2023.8.10 Puppet Enterprise versions 2025.0.0 through 2025.11.2 Description An authenticated user with administrative privileges can execute arbitrary shell commands by providing a specially crafted...
CVE-2026-85979: Improper Neutralization of Special Elements used in an OS Command
Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...
CVE-2026-8804
Puppet resourceapi shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of th...
UBUNTU-CVE-2026-8804
Puppet resourceapi shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of th...
CVE-2026-8804
The CVE concerns Puppet’s resource_api (bundled with Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x). A vulnerability exists where the sensitive flag on parameters defined via the resource-api is not preserved, causing values such as passwords to be stored in cleartext in the agent’s l...
CVE-2026-8804 Cleartext Storage of Sensitive Information for Puppet Resource API
Puppet resourceapi shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of th...
CVE-2026-8804
Puppet resourceapi shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of th...
CVE-2026-8804: Cleartext Storage in a File or on Disk
Puppet resourceapi shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of th...
com.arkea.satd:xlrelease-var-setter (>=0.2, <=0.4), io.jenkins.blueocean:blueocean (>=1.0.0-b02, <=1.0.0-b12) +3 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.22)
org.jenkins-ci.plugins:script-security MAVEN version 1.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.arkea.satd:xlrelease-var-setter =0.2, =1.0.0-b02, =1.2.1, =2.0, =0.1, =0.5 Sourc...
com.arkea.satd:xlrelease-var-setter (>=0.2, <=0.4), io.jenkins.blueocean:blueocean (>=1.0.0-b02, <=1.0.0-b12) +3 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1.22)
org.jenkins-ci.plugins:script-security MAVEN version 1.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.arkea.satd:xlrelease-var-setter =0.2, =1.0.0-b02, =1.2.1, =2.0, =0.1, =0.5 Sourc...
