CVE-2026-84659

A flaw was found in the Jenkins Script Security Plugin. This vulnerability allows an attacker to bypass security restrictions by disabling the global script sandbox. By exploiting a missing permission check through Stapler data binding, an attacker can execute arbitrary code, potentially...

CVE-2026-93598 ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does...

CVE-2026-93598 ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does...

PT-2026-95377

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.9.1 Description The polyglot script sandbox contains an incomplete deny-list within com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED. While java.util.ResourceBundle is listed, the filter uses exact equalit...

bin-maker (3.1.0), checksec-py (>=0.3.6, <=0.3.8) +3 more potentially affected by CVE-2025-59042 via pyinstaller (4.0.0)

pyinstaller PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyinstaller and may be impacted: - bin-maker 3.1.0 - checksec-py =0.3.6, =1.2.2, =1.8.2 Source cves: CVE-2025-59042 Source advisory: OSV:PYSEC-2026-1813...

bin-maker (3.1.0), checksec-py (>=0.3.6, <=0.3.8) +3 more potentially affected by CVE-2025-59042 via pyinstaller (4.0.0)

pyinstaller PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyinstaller and may be impacted: - bin-maker 3.1.0 - checksec-py =0.3.6, =1.2.2, =1.8.2 Source cves: CVE-2025-59042 Source advisory: OSV:GHSA-P2XP-XX3R-MFFC...

bin-maker (3.1.0), checksec-py (>=0.3.6, <=0.3.8) +3 more potentially affected by CVE-2023-49797 via pyinstaller (4.0.0)

pyinstaller PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyinstaller and may be impacted: - bin-maker 3.1.0 - checksec-py =0.3.6, =1.2.2, =1.8.2 Source cves: CVE-2023-49797 Source advisory: OSV:PYSEC-2023-292...

bin-maker (3.1.0), checksec-py (>=0.3.6, <=0.3.8) +3 more potentially affected by CVE-2023-49797 via pyinstaller (4.0.0)

pyinstaller PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyinstaller and may be impacted: - bin-maker 3.1.0 - checksec-py =0.3.6, =1.2.2, =1.8.2 Source cves: CVE-2023-49797 Source advisory: OSV:GHSA-9W2P-RH8C-V9G5...

openSUSE 15 Security Update : squirrel (openSUSE-SU-2023:0080-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2023:0080-1 advisory. - sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read in the core interpreter that can lead to Code Execution. If a...

CVE-2021-41556

sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read in the core interpreter that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all...

Cross site scripting

sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read in the core interpreter that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all...

CVE-2021-41556

sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read in the core interpreter that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all...

CVE-2019-8308

CVE-2019-8308 affects Flatpak before 1.0.7 and 1.1.x and 1.2.x before 1.2.3, where the /proc is exposed in the apply_extra sandbox, enabling a local attacker to modify a host-side executable. CVSS v3 base score 8.2 (HIGH) with LOCAL attack vector, LOW privileges required, UI required, and impact ...

CVE-2019-1003001

A flaw was found in Jenkins Pipeline. In the Declarative plugin, the script sandbox protection could be circumvented during the script compilation phase by applying AST. Both the pipeline validation REST APIs and the actual script/pipeline execution are affected. This allows users with Overall/Re...

CVE-2017-1000095

The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAtObject, String, Object; DefaultGroovyMethods.getAtObject, String. These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild'rawBuild' rather than...

Default credentials

The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAtObject, String, Object; DefaultGroovyMethods.getAtObject, String. These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild'rawBuild' rather than...

CVE-2017-1000095: Incorrect Permission Assignment for Critical Resource

The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAtObject, String, Object; DefaultGroovyMethods.getAtObject, String. These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild'rawBuild' rather than...

CVE-2017-1000095

The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAtObject, String, Object; DefaultGroovyMethods.getAtObject, String. These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild'rawBuild' rather than...

CVE-2017-1000095

The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAtObject, String, Object; DefaultGroovyMethods.getAtObject, String. These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild'rawBuild' rather than...

CVE-2017-1000095

CVE-2017-1000095 concerns the Jenkins Script Security plugin where the default whitelist contains unsafe entries (DefaultGroovyMethods.putAt and DefaultGroovyMethods.getAt) that bypass sandbox restrictions (e.g., via currentBuild['rawBuild'] vs currentBuild.rawBuild) and allow accessing private d...