122398 matches found
PT-2026-93765
Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1415.v9a f9b 3a c253d and earlier Description An issue exists where the plugin fails to verify the method called through a proxy created when a sandboxed script coerces a value to an interface. If the...
CVE-2026-92122: Protection Mechanism Failure
Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define an...
PT-2026-93760
Name of the Vulnerable Software and Affected Versions Plate versions prior to 53.3.11 Plate versions 54.0.0-beta.0 through 54.0.0-beta.1 Description Core HTML deserialization APIs parse supplied HTML strings within the active document. When untrusted or cross-user HTML is passed to these APIs,...
CVE-2026-92625: Missing Authentication for Critical Function
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/license/restartService endpoint is reachable without authentication and invokes an internal routine that terminates the iDSecure service process and relaunches it by way of a generated bat...
PT-2026-93768
Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description The plugin fails to reject the @GroovyASTTransformationClass annotation. This allows users with permissions to define and execute sandboxed scripts, such as...
CVE-2026-92126: Use of Externally-Controlled Input to Select Classes or Code
Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable...
PT-2026-93719
Name of the Vulnerable Software and Affected Versions Advantech EKI-1242EIMS version V1.06.01 Description The Modbus transaction management interface contains a Cross-site Scripting XSS issue, which occurs when an application includes untrusted data in a web page without proper validation or...
CVE-2026-92128: Download of Code Without Integrity Check
Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary code in the context ...
PT-2026-93766
Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description Attackers with permission to define and run sandboxed scripts, including Pipelines, can bypass sandbox protection to execute arbitrary code in the context of th...
PT-2026-93358
An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot...
CVE-2026-92123: Protection Mechanism Failure
Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not intercept operations performed on a null receiver method calls, property and attribute accesses, and array accesses, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the...
Sandbox bypass vulnerability in script-security
script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Groovy coerces a value to an interface by creating a proxy that forwards each interface method call to a method of the same name on that value...
Sandbox bypass vulnerability in script-security
script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Groovy casts a collection to another type using the elements of that collection, either passing them to a constructor of that type or casting eac...
Sandbox bypass vulnerability in script-security
script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Groovy allows an existing class to be extended at runtime with additional methods. script-security 1415.v9af9b3ac253d and earlier does not check...
Sandbox bypass vulnerability in script-security
script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. script-security 1415.v9af9b3ac253d and earlier does not intercept operations performed on a null receiver method calls, property and attribute...
Sandbox bypass vulnerability in script-security
script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Groovy's @Builder annotation generates builder code at compile time using the strategy class named by its builderStrategy member, which can be on...
TOCTOU race condition in script-security
script-security allows Groovy scripts to load classpath entries from JAR files, specified either by file path or by URL, which administrators must approve before any script is allowed to use them. script-security 1415.v9af9b3ac253d and earlier downloads a JAR file specified by URL twice when a...
Sandbox bypass vulnerability in script-security
script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. script-security 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, which a script can use to link an...
Classpath approval bypass vulnerability in script-security
script-security allows Groovy scripts to load classpath entries from JAR files, which administrators must approve before any script is allowed to use them. script-security 1415.v9af9b3ac253d and earlier automatically approves the classpath entries in an item configuration when a user with...
CVE-2026-92125: Improper Control of Generation of Code
Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox...