GHSA-9WM7-8QF3-9V98 Jenkins AppSpider Plugin does not perform a permission check in a method implementing form validation

Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL. AppSpider Plugin 1.0.18 requires Overall/Administer permission to use the affected...

CVE-2026-48927

Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs or views...

CVE-2026-48924

Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...

CVE-2026-48923

Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL...

CVE-2026-44971

GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an...

CVE-2026-48972

creationtimestamp| type| source ---|---|--- 2026-05-27 15:01:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmtrmcxtdz2r...

CVE-2026-45912

creationtimestamp| type| source ---|---|--- 2026-05-27 15:00:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116647133965743789 2026-07-02 06:23:09+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260702 2026-08-03 07:24:05+00:00|...

CVE-2026-44902 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request

opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint default 0.0.0.0:9464 has no error handling around URL parsing, so a request with an invalid...

CVE-2026-44971 GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration

GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an...

CVE-2026-48902

creationtimestamp| type| source ---|---|--- 2026-05-27 14:35:37+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmtq56q4l22q...

CVE-2026-48905

creationtimestamp| type| source ---|---|--- 2026-05-27 14:35:37+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmtq56q4l22q...

CVE-2026-48898

creationtimestamp| type| source ---|---|--- 2026-05-27 14:35:36+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmtq56q4l22q 2026-06-22 05:31:52+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3mou5uunp2t2b...

CVE-2026-42184 Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands

Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's islocalurl function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to...

EUVD-2026-32527

Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's islocalurl function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to...

CVE-2026-48927

Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs or views...

CVE-2026-48923

Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL...

CVE-2026-48923

Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL...

CVE-2026-48923

Jenkins AppSpider Plugin 1.0.17 and earlier is affected by a permission-check bypass in a form-validation method. The issue allows attackers with Overall/Read permissions to connect to an attacker-specified URL, enabling potential external requests from the plugin context. The affected component ...

CVE-2026-48906

creationtimestamp| type| source ---|---|--- 2026-05-27 13:43:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmtna4mrm42c...

CVE-2026-45840

creationtimestamp| type| source ---|---|--- 2026-05-27 13:37:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmtmvemvbk2i 2026-07-01 02:35:05+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260630 2026-07-02 07:17:20+00:00| seen...