CVE-2026-92129: Protection Mechanism Failure

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute...

CVE-2026-84397: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

PT-2026-93769

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description Users with permission to define and run sandboxed scripts, such as Pipelines, can execute code outside the sandbox. This occurs because the plugin fails to reje...

PT-2026-93765

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1415.v9a f9b 3a c253d and earlier Description An issue exists where the plugin fails to verify the method called through a proxy created when a sandboxed script coerces a value to an interface. If the...

CVE-2026-76855

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7webauthlogdumpcgi.c, auditgetcgi.c, and moddispatchauth/plan.json. Attackers can query these audit components to obtain other users' session and browsing history data...

CVE-2026-55863

motionEye mEye is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post method in motioneye/handlers/action.py lacks the BaseHandler.auth decorator, allowing an unauthenticated remote...

EUVD-2026-78592

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

CVE-2026-53966

In XWiki Platform (a generic wiki platform), the Live Data edit REST API fails to perform normal document-saving authorization checks when a user modifies page rights. Any user with edit permission can escalate to script right, enabling execution of potentially dangerous Velocity scripts or deliv...

CVE-2026-53966

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

CVE-2026-53966: Missing Authorization

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

Malicious code in ultra-ws (npm)

Source: amazon-inspector a3cd852fb9e34a4705cad99a8022db52461e1325daddfa1425df17bbc3b7ac08 package.json declares a dependency node-net-pool whose source is a tarball URL on the main branch of a random third-party GitHub account...

Astra Linux – Vulnerability in Firefox and Thunderbird

If a document creates a sandboxed iframe without allow-scripts, and then appends an element to the iframe’s document that has a JavaScript event handler—the event handler will still be executed despite the iframe being in a sandbox. This vulnerability affects Firefox versions earlier than 97,...

Astra Linux – Vulnerability in Zabbix

JavaScript preprocessing, webhooks, and global scripts can lead to uncontrolled utilization of CPU, memory, and disk I/O resources. The ability to preprocess/webhook/configure and test global scripts is only available to Administrative roles Admin and Superadmin. Administrative privileges should...

Malicious code in joko-klanting70-riris (npm)

Source: amazon-inspector 6e98d0c77d583b569536c9ed5708885ae720ffca47de2046b862532060be8fc5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klanting57-breki (npm)

Source: amazon-inspector 0c428c01fadb33d32b8b138d77fb04ac1c17b0f9dafd1a392bbc904447537f86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-ketoprak70-breki (npm)

Source: amazon-inspector d1f69c051add2ae3619e6903f0261bf62c253b5095f0c95abee5c9c54f25ac83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klanting72-miaww (npm)

Source: amazon-inspector 03dba51cbf38ac8e5cbde1fbecfb2182204285b77564de32f21203dc936f9b5c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klanting55-breki (npm)

Source: amazon-inspector fcd00e3a02dd3249203d511087599b3d08f8fa63ce46249bfe3d6ab12c008a12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klanting28-sluey (npm)

Source: amazon-inspector 3186fb531c97a5c8f8d341128ac55a50ac9f5e14ed8ec769e14c2cf80e21f0c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-ketan37-apidev (npm)

Source: amazon-inspector 128bd546b85f3471f53426b2ac30ad0cc90cc2aa82b0b1226c20a032bb9d8c89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...