CVE-2026-39897

Cacti is an open source performance and fault management framework. Versions 1.2.30 and below contain a Reflected XSS vulnerability in the htmlauthfooter. This issue has been fixed in version 1.2.31...

CVE-2026-55570 SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape the untrusted fields name, version, author, description when they are serialized into the data-obj HTML attribute of each marketplace card. Because the attribute is single-quoted and the value is...

Jenkins MCP Server Plugin missing a permission check

Jenkins MCP Server Plugin 0.177.v629fdb2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build. This allows attackers with Item/Read permission to obtain the Pipeline script of jobs. MCP Server Plugin...

GHSA-MPFF-XHG4-VR45 Jenkins MCP Server Plugin missing a permission check

Jenkins MCP Server Plugin 0.177.v629fdb2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build. This allows attackers with Item/Read permission to obtain the Pipeline script of jobs. MCP Server Plugin...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +94 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.13)

org.jenkins-ci.plugins:script-security MAVEN version 1.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - aendter.jenkins.plugins:filesystem-list-parameter-plugin 0.0.6 -...

io.jenkins.plugins:cdevents (>=1-37.v6412b_91c3799, <=1-40.vb_3d2c94f2379), io.jenkins.plugins:pipeline-agent-build-history (>=20.v2cb_6cc0a_7d81, <=34.v570d1a_452f30) +4 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1273.v66c1964f0dfd)

org.jenkins-ci.plugins:script-security MAVEN version 1273.v66c1964f0dfd is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:cdevents =1-37.v6412b91c3799, =20.v2cb6cc0a7d81,...

io.jenkins.blueocean:blueocean (>=1.0.0-b25, <=1.1.7), io.jenkins.blueocean:blueocean-dashboard (>=1.0.0-b25, <=1.0.1) +25 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.26)

org.jenkins-ci.plugins:script-security MAVEN version 1.26 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b25, =1.0.0-b25, =1.0.0-b25, =1.0.0-b25,...

io.fabric8.pipeline:kubernetes-pipeline-aggregator (1.3), io.fabric8.pipeline:kubernetes-pipeline-core (1.3) +6 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.14)

org.jenkins-ci.plugins:script-security MAVEN version 1.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.fabric8.pipeline:kubernetes-pipeline-aggregator 1.3 -...

org.biouno:uno-choice (>=2.8.5, <=2.8.6), org.jenkins-ci.plugins:job-dsl (1.90) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1365.v4778ca_84b_de5)

org.jenkins-ci.plugins:script-security MAVEN version 1365.v4778ca84bde5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.biouno:uno-choice =2.8.5, =2.8.6 - org.jenkins-ci.plugins:job-dsl...

io.jenkins.plugins:pipeline-agent-build-history (>=44.va_44d94c22f21, <=90.vf089ff0feff9), io.jenkins.plugins:pipeline-groovy-lib (>=727.ve832a_9244dfa, <=745.vdf6077913de0) +4 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1326.vdb_c154de8669)

org.jenkins-ci.plugins:script-security MAVEN version 1326.vdbc154de8669 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:pipeline-agent-build-history =44.va44d94c22f21,...

au.com.versent.jenkins.plugins:ignore-committer-strategy (>=37.v0d3157c4a_ef8, <=63.v7e87d06b_a_30c), com.amazon.jenkins.fleet:ec2-fleet (>=4.1.0.506.v619d63b_ec9d8, <=4.2.1.515.v100267825939) +130 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1369.v9b_98a_4e95b_2d)

org.jenkins-ci.plugins:script-security MAVEN version 1369.v9b98a4e95b2d is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - au.com.versent.jenkins.plugins:ignore-committer-strategy...

com.paul8620.jenkins.plugins:pipeline-aggregator-view (>=114.v98e9735f6193, <=119.v4b_ec11953552), com.tikalk.hudson.plugins:notification (1.18) +20 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1341.va_2819b_414686)

org.jenkins-ci.plugins:script-security MAVEN version 1341.va2819b414686 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.paul8620.jenkins.plugins:pipeline-aggregator-view...

org.jenkins-ci.plugins:webhook-step (327.vb_58f208a_7783) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1281.v22fb_899df1a_e)

org.jenkins-ci.plugins:script-security MAVEN version 1281.v22fb899df1ae is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:webhook-step 327.vb58f208a7783 Source cves:...

com.bmc.ims:bmc-cfa (>=198.vfe106798d1a6, <=200.va3bf13f31cdd), com.bmc.ims:bmc-change-manager-imstm (>=81.v560fa_d742db_d, <=83.v761069998a_34) +39 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1385.v7d2d9ec4d909)

org.jenkins-ci.plugins:script-security MAVEN version 1385.v7d2d9ec4d909 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.bmc.ims:bmc-cfa =198.vfe106798d1a6, =81.v560fad742dbd, =1.46.0,...

com.openshift.jenkins.plugins:openshift-client (>=1.1.0.420.v8817277c1990, <=1.1.0.422.va_241c0c97580), com.paul8620.jenkins.plugins:pipeline-aggregator-view (104.v94a_e5f6cdb_c3) +45 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1251.vfe552ed55f8d)

org.jenkins-ci.plugins:script-security MAVEN version 1251.vfe552ed55f8d is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.openshift.jenkins.plugins:openshift-client =1.1.0.420.v8817277c199...

com.bmc.ims:bmc-change-manager-imstm (113.v47fc813df436), com.fuzzpro.jenkins-plugins:multibranch-job-tear-down (73.ve2b_957fc2921) +12 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1399.ve6a_66547f6e1)

org.jenkins-ci.plugins:script-security MAVEN version 1399.ve6a66547f6e1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.bmc.ims:bmc-change-manager-imstm 113.v47fc813df436 -...

org.jenkins-ci.plugins:gradle (2.12.0.1) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1138.v8e727069a_025)

org.jenkins-ci.plugins:script-security MAVEN version 1138.v8e727069a025 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:gradle 2.12.0.1 Source cves: CVE-2026-57281...

org.jenkins-ci.plugins:pipeline-utility-steps (>=1.4.0, <=1.5.1) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.29.1)

org.jenkins-ci.plugins:script-security MAVEN version 1.29.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:pipeline-utility-steps =1.4.0, =1.5.1 Source cves:...

com.fuzzpro.jenkins-plugins:multibranch-job-tear-down (>=61.v68b_d7264b_643, <=69.vc3f564093641), io.jenkins.configuration-as-code:test-harness (>=2037.v8e5349845172, <=2134.ve13a_2fc90835) +58 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1378.vf25626395f49)

org.jenkins-ci.plugins:script-security MAVEN version 1378.vf25626395f49 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.fuzzpro.jenkins-plugins:multibranch-job-tear-down =61.v68bd7264b64...

io.jenkins.plugins:coverage-badges-extension (>=-rc6.886d29ff0f4d, <=47.v41e62ecf0928), jp.ikedam.jenkins.plugins:scoring-load-balancer (>=68.va_4591100d6a_b, <=97.v8e470ff53e15) +9 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1294.v99333c047434)

org.jenkins-ci.plugins:script-security MAVEN version 1294.v99333c047434 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:coverage-badges-extension =-rc6.886d29ff0f4d,...