Sandbox bypass vulnerability in script-security

script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. script-security 1415.v9af9b3ac253d and earlier does not intercept operations performed on a null receiver method calls, property and attribute...

Sandbox bypass vulnerability in script-security

script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Groovy coerces a value to an interface by creating a proxy that forwards each interface method call to a method of the same name on that value...

Sandbox bypass vulnerability in script-security

script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Groovy's @Builder annotation generates builder code at compile time using the strategy class named by its builderStrategy member, which can be on...

CVE-2026-92127: Improper Control of Generation of Code

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpat...

Sandbox bypass vulnerability in script-security

script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. script-security 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, which a script can use to link an...

Classpath approval bypass vulnerability in script-security

script-security allows Groovy scripts to load classpath entries from JAR files, which administrators must approve before any script is allowed to use them. script-security 1415.v9af9b3ac253d and earlier automatically approves the classpath entries in an item configuration when a user with...

TOCTOU race condition in script-security

script-security allows Groovy scripts to load classpath entries from JAR files, specified either by file path or by URL, which administrators must approve before any script is allowed to use them. script-security 1415.v9af9b3ac253d and earlier downloads a JAR file specified by URL twice when a...

Sandbox bypass vulnerability in script-security

script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Groovy casts a collection to another type using the elements of that collection, either passing them to a constructor of that type or casting eac...

Sandbox bypass vulnerability in script-security

script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Groovy allows an existing class to be extended at runtime with additional methods. script-security 1415.v9af9b3ac253d and earlier does not check...

CVE-2026-92123: Protection Mechanism Failure

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not intercept operations performed on a null receiver method calls, property and attribute accesses, and array accesses, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the...

SUSE CVE-2026-92061

Incorrect boundary conditions in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...

SUSE CVE-2026-92078

Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

django-DefectDojo v3.3.100

DefectDojo | ---|--- DefectDojo is a DevSecOps, ASPM application security posture management, and vulnerability management tool. DefectDojo orchestrates end-to-end security testing, vulnerability tracking, deduplication, remediation, and reporting. Demo Pro Edition: pro.demo.defectdojo.com OWASP...

CLSA-2026-1789513129 TuxCare security update for io.netty (4 CVEs)

TuxCare rebuilt 38 io.netty packages to address 4 CVEs. Fixed in 4.1.43.Final-tuxcare.1...

GHSA-2H44-8472-FRJJ

creationtimestamp| type| source ---|---|--- 2026-09-15 22:54:25+00:00| seen| https://bsky.app/profile/standup.thecompound.tech/post/3mvlprda2mw2w...

CVE-2026-61559

creationtimestamp| type| source ---|---|--- 2026-09-15 22:35:01+00:00| published-proof-of-concept| https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-2h44-8472-frjj 2026-09-15 22:54:24+00:00| seen| https://bsky.app/profile/standup.thecompound.tech/post/3mvlprcfb7g2w 2026-09-16...

CVE-2026-91728

An integer overflow flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=556715288...

CLSA-2026-1789510477 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 5.3.30-tuxcare.11...

CVE-2026-92000

creationtimestamp| type| source ---|---|--- 2026-09-15 22:00:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvlmqp54zu2m...

CVE-2026-76853 Netcore NR268 1.7.121109 Security Check Bypass in parame_put_file.cgi

Netcore NR268 firmware version 1.7.121109 contains a security check bypass vulnerability in the parameputfile.cgi restore archive prefix validation. Attackers can exploit the flawed prefix check in putparamefilecgi.c to bypass restricted restore archive handling...