CVE-2026-70431

Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM...

CVE-2026-70431

Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM...

CVE-2026-70426

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...

CVE-2026-70426

CVE-2026-70426 affects Jenkins with Remoting 3384.* and earlier (including Jenkins 2.575 and earlier, LTS 2.568.1 and older). The vulnerability arises because the JEP-200 deserialization filter is not applied to classes resolved via a fallback path in Remoting’s deserialization, allowing agent pr...

CVE-2026-70426

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...

CVE-2026-70426

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...

EUVD-2026-53569

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...

Malicious code in uzair-rajput-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b371d3a1e96e6e79066cf8f620a85867c73eb9ddbe68a81a33589e85146c4df6 The package is published as a chalk/tinygradient color-gradient wrapper, and its ESM entrypoint dist/index.js matches that description. The CJS main...

MAL-2026-13360 Malicious code in uzair-rajput-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b371d3a1e96e6e79066cf8f620a85867c73eb9ddbe68a81a33589e85146c4df6 The package is published as a chalk/tinygradient color-gradient wrapper, and its ESM entrypoint dist/index.js matches that description. The CJS main...

Malicious code in test-dev-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44b80ff2bcf35e5c92c1c8a551b943d334f94793d693ce846707986613db8108 src/config.js hardcodes a remote host as the English-word phrase "Four Five P Nine Five P One Eight Six P Two Three Seven" and decodes it at import...

MAL-2026-13359 Malicious code in test-dev-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44b80ff2bcf35e5c92c1c8a551b943d334f94793d693ce846707986613db8108 src/config.js hardcodes a remote host as the English-word phrase "Four Five P Nine Five P One Eight Six P Two Three Seven" and decodes it at import...

CVE-2026-71281

A flaw was found in peft. The LoRA-GA and CorDA initialization modules within Hugging Face peft improperly call torch.load without the weightsonly=True parameter. This oversight allows for full pickle deserialization when loading a malicious cache or covariance file. A remote attacker could explo...

CVE-2026-51992

A flaw was found in ClickHouse Server. A SQL Injection vulnerability exists in the create dictionaries function, which allows a remote attacker to execute arbitrary code. This could lead to a complete compromise of the affected system...

MAL-2026-13358 Malicious code in app-kst-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08cfc426d2f4b29bba2b81f2eb56eeee32ab114338a51fae5eeced2571e6b2d9 On npm install, package.json's postinstall runs node test.js, which triggers three malicious paths against the installer. 1 A recursive scan of the...

Malicious code in app-kst-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08cfc426d2f4b29bba2b81f2eb56eeee32ab114338a51fae5eeced2571e6b2d9 On npm install, package.json's postinstall runs node test.js, which triggers three malicious paths against the installer. 1 A recursive scan of the...

Veeam Service Provider Console’s vulnerabilities

Veeam has identified several vulnerabilities in the Veeam Service Provider Console. These vulnerabilities exist in various components of the Veeam Service Provider Console. An unauthorized attacker can act as a managed agent within the system and thereby obtain the corresponding login credentials...

MAL-2026-13357 Malicious code in app-hsu-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad1ccd2bfbe4abd87e980067608328d6c0a6cb3d1145d8d8ff8d72a22667f00d On npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesting/backdoor routines. The...

Malicious code in app-hsu-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad1ccd2bfbe4abd87e980067608328d6c0a6cb3d1145d8d8ff8d72a22667f00d On npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesting/backdoor routines. The...

CVE-2026-17625 Langflow is affected by OS Command Injection in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special element...

CVE-2026-17625

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special element...