CVE-2026-70441

Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission...

CVE-2026-70448

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...

CVE-2026-70448

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...

CVE-2026-71288

Koha's guided report builder reports/guidedreports.pl reads the orderby CGI parameter and, for each value, a dynamically-named orderovalue parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation: my @orderby = $input-multiparam'orderby'; foreach my...

MAL-2026-12313 Malicious code in @ccfly/setup-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 409d11825a61bed068425296e83dcc0c87427579f7b5d724ec52e5e87465f2b5 The package ships a prebuilt darwin/x64 Mach-O binary containing a Go agent module github.com/ccfly/rescue that, when executed, connects to a hardcod...

Malicious code in @ccfly/setup-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 409d11825a61bed068425296e83dcc0c87427579f7b5d724ec52e5e87465f2b5 The package ships a prebuilt darwin/x64 Mach-O binary containing a Go agent module github.com/ccfly/rescue that, when executed, connects to a hardcod...

EUVD-2026-53373

Koha's guided report builder reports/guidedreports.pl reads the orderby CGI parameter and, for each value, a dynamically-named orderovalue parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation: my @orderby = $input-multiparam'orderby'; foreach my...

MAL-2026-12043 Malicious code in sextant-cli-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53 The package is a platform-specific leaf linux/arm64 whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits...

XXE vulnerability in ivy-report

ivy-report 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted Ivy report XML file that uses external entities for extraction of secrets from the Jenkins controller o...

Stored XSS vulnerability in summary_report

summaryreport 1.15 and earlier does not escape the job name in a JavaScript context in build report pages. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission. As of publication of this advisory, there is no fix...

CVE-2026-64630

A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link...

CVE-2026-64630

Technical details (affected products, affected component, root cause, exact impact, or remedies) are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-52759

A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link...

CVE-2026-64630

A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link...

CVE-2026-70373 Koha: SQL Injection in reports/issues_stats.pl

Koha's reports/issuesstats.pl the circulation statistics report builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into...

Security Updates for Power BI Report Server (July 2026)

The Power BI Report Server installation on the remote host is missing a security update. It is, therefore, affected by a spoofing vulnerability: - Improper neutralization of input during web page generation 'cross-site scripting' in Power BI allows an authorized attacker to perform spoofing over ...

CVE-2026-69093

Admidio before 5.0.11 does not validate the admcsrftoken in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters delete and copy. An attacker can trick an authenticated administrator into visiting a crafted URL to delete ...

WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin JetEngine versions = 3.8.13.1...

CVE-2026-69093

Admidio before 5.0.11 does not validate the admcsrftoken in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters delete and copy. An attacker can trick an authenticated administrator into visiting a crafted URL to delete ...

CVE-2026-69093 Admidio before 5.0.11 CSRF via category-report preferences

Admidio before 5.0.11 does not validate the admcsrftoken in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters delete and copy. An attacker can trick an authenticated administrator into visiting a crafted URL to delete ...