116402 matches found
CVE-2026-84658
The Jenkins Script Security Plugin (versions 1412.v7737b_3405f86 and earlier) contains a vulnerability where a constructor used to load script approval configuration is incorrectly annotated with @DataBoundConstructor . This oversight in the Stapler web framework's data-binding mechanism allows a...
CVE-2026-84658
Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...
CVE-2026-84659
Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...
CVE-2026-84659
The Jenkins Script Security Plugin (version 1412.v7737b_3405f86 and earlier) fails to enforce a permission check in the method governing the "Force the use of the sandbox globally in the system" setting. This allows attackers to disable the global sandbox via Stapler data binding . To remediate t...
EUVD-2026-70125
Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...
CVE-2026-84658
Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...
CVE-2026-84659
Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...
EUVD-2026-70124
Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...
CVE-2026-84659
Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...
CVE-2026-84658
Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...
CVE-2026-84803
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and...
EUVD-2026-69929
Unauthenticated Cross Site Scripting XSS in TrustedSite = 1.2.5 versions...
CVE-2026-84803
SiYuan before v3.8.2 is affected by a stored cross-site scripting (XSS) vulnerability in its asset-serving component. The root cause is an incomplete extension blocklist that fails to cover script-capable file types such as .xht, .ehtml, .xsl, .xbl, and .rdf, which resolve to executable media typ...
CVE-2026-84803 SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and...
PrivescCheck v2026.09.02-1
PrivescCheck Quickly identify common Windows vulnerabilities and configuration issues that are not necessarily covered by public security standards, and collect useful information for exploitation and post-exploitation tasks. !IMPORTANT A major aspect to be aware of when using this tool is that a...
SUSE CVE-2026-40013
An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
CVE-2026-81807 Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification
The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators...
Malicious code in cminhouse-api-gateway-nodejs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c42971bbb30a4cb0a1da27be3953339fdbda449e4d10e997aac72212df0a8b1d index.js is wired as the package's postinstall script and also runs on require via main. After skipping CI/test/Docker environments guards on...