CVE-2026-84666

Jenkins Job Configuration History Plugin versions 1367.vc8fa_b_15101dc and earlier are vulnerable to improper access control via Stapler data binding . The plugin incorrectly uses the @DataBoundConstructor annotation on a constructor for its global configuration, which is not intended to be invok...

CVE-2026-84667

CVE-2026-84667 affects Jenkins ThinBackup Plugin 2.1.4 and earlier . The root cause is the use of the @DataBoundConstructor annotation, which allows Stapler to invoke @DataBoundSetter methods managing the plugin's backup configuration. This enables an authenticated attacker to redirect backup wri...

CVE-2026-84665

Jenkins SonarQube Scanner Plugin versions 2.18.3 and earlier do not restrict URL schemes for dashboard links generated from SonarQube scanner results, permitting the javascript: scheme. This leads to a stored cross-site scripting (XSS) vulnerability exploitable by attackers holding Item/Configure...

CVE-2026-84664

CVE-2026-84664 affects the Jenkins GitLab Plugin version 1.9.16 and earlier. The root cause is an improper use of Stapler's @DataBoundConstructor annotation on the constructor for the global GitLab connection configuration, which allows Stapler to invoke @DataBoundSetter-annotated methods and ove...

CVE-2026-84663

A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin (pipeline-groovy-lib) versions 798.v5cc688825312 and earlier stems from an HTTP endpoint that does not require POST requests, allowing attackers to delete shared library caches . The issue was reported ...

CVE-2026-84661

Jenkins Pipeline: Build Step Plugin version 599.v4b_67ea_11b_152 and earlier contains a missing permission check in the waitForBuild step. When the propagateAbort parameter is set to true, the plugin cancels the downstream build without verifying that the build's associated authentication holds I...

CVE-2026-84662

Jenkins LDAP Plugin (ldap) versions 807.809.vd3a_4e5e4ec98 and earlier suffer from an improper access control flaw that enables Server-Side Request Forgery (SSRF) . The plugin's use of Stapler's @DataBoundConstructor annotation on a constructor that connects to a specified URL allows attackers ca...

CVE-2026-84660

Jenkins Pipeline: Build Step Plugin (pipeline-build-step) 599.v4b_67ea_11b_152 and earlier contains a missing permission check that allows downstream builds to be canceled even when the triggering build's authentication lacks Item/Cancel permission on the downstream job. The issue is triggered wh...

CVE-2026-84658

Jenkins Script Security Plugin versions 1412.v7737b_3405f86 and earlier are affected by an improper access control vulnerability (SECURITY-3986). The plugin uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration but is not intended to be invoked by use...

CVE-2026-84659

Jenkins Script Security Plugin versions 1412.v7737b_3405f86 and earlier are affected by an improper access control vulnerability. A @DataBoundSetter annotated method controlling the "Force the use of the sandbox globally in the system" setting does not enforce a permission check, allowing an auth...

CVE-2026-84656

A missing Item/Read permission check in an HTTP endpoint of Jenkins 2.579 and earlier (and LTS 2.568.2 and earlier ) allows an attacker with Item/Read permission on at least one job to read build parameter names and values of other jobs they should not have access to. This is tracked as SECURITY-...

CVE-2026-84657

In Jenkins 2.579 and earlier (LTS 2.568.2 and earlier), the build CLI command with the -s flag does not check the Item/Cancel permission when canceling a build after the CLI client is interrupted. Because Jenkins merges duplicate build requests into a single queue item, an attacker holding only I...

CVE-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API. Attackers who can control map property names can inject arbitrary fields into JSON and Python API responses, leading to a low-impact integrity issue (CVSS ...

CVE-2026-84654

Jenkins (via the Stapler web framework) is affected by a form data binding flaw in versions 2.579 and earlier (LTS 2.568.2 and earlier ). The root cause is that Stapler's form data binding allows setting public static fields of the bound configuration object, enabling attackers with the ability t...

CVE-2026-84653

Jenkins versions 2.421 through 2.579 and LTS 2.426.1 through 2.568.2 contain an incorrect permission check in the Appearance configuration page (introduced in Jenkins 2.421). Attackers holding the Overall/Manage permission can modify Appearance configuration options that should be restricted to a...

CVE-2026-84651

Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) contain an unsafe deserialization flaw in the REST API and CLI endpoints used to update agent configuration. An attacker holding Agent/Configure permission on one agent can specify a different agent's name in the submitted XML, overwriting that ...

CVE-2026-84652

CVE-2026-84652 is a session fixation vulnerability in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) . When a user authenticates via the "remember me" cookie, Jenkins does not rotate the session, allowing an attacker serving content on a sibling subdomain (e.g., evil.example.org for Jenkins ...

CVE-2026-84650

Jenkins versions 2.579 and earlier and LTS 2.568.2 and earlier are affected by an unsafe deserialization flaw (SECURITY-4032). Fields declared transient are excluded from serialization but still read back during deserialization for backward compatibility with existing configuration files. Attacke...

CVE-2026-84649

CVE-2026-84649 (CVSS 8.8, HIGH) affects the Stapler web framework bundled in Jenkins 2.447–2.579 (LTS 2.452.1–2.568.2). An HTTP endpoint serving dynamically generated JavaScript resources embeds the user's CSRF token (crumb) as a string literal , allowing an attacker who controls a page on the sa...

CVE-2026-84648

CVE-2026-84648 is a stored cross-site scripting (XSS) vulnerability in the system log viewer of Jenkins 2.579 and earlier (LTS 2.568.2 and earlier). The root cause is the failure to escape log record metadata (source, level, and timestamp) before rendering, allowing attackers who control agent pr...

CVE-2026-84647

CVE-2026-84647 affects Stapler (the web framework used by Jenkins) in versions up to 2107.v8dfcb_e8ed317 (except 2088.2093.vd7c3e58008a_6), shipped in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier . The root cause is that Stapler's form data binding does not restrict the object types that ca...

CVE-2026-84646

Jenkins (versions 2.579 and earlier, LTS 2.568.2 and earlier) is affected by a lack of type restriction in XML deserialization , allowing an attacker with Overall/Read permission to create user objects by submitting crafted XML. The root cause is that user objects can appear as nested field value...

CVE-2026-84645

Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) contains a deserialization vulnerability (SECURITY-3972). Objects implementing PersistenceRoot—types that store configuration in independent top-level files such as global configuration and jobs—can appear as nested field values in user-submitte...

CVE-2026-18058

The mobile Smart Connect dashboard UI (referenced via Motorola support, with CNA from Lenovo PSIRT ) was vulnerable to manipulation by third-party apps . When combined with a phishing attack , this manipulation could lead to privilege escalation for an attacker within the system. The vulnerabilit...

CVE-2026-84838

CVE-2026-84838 is a command injection vulnerability in rpmuncompress , a component of the RPM package management toolset. The root cause is that archive filenames containing shell metacharacters are not properly escaped before being passed to shell command strings via popen() , allowing a local a...

CVE-2026-84837

A command injection vulnerability was identified in rpm , specifically in the gettarspec function used by rpmbuild -t*. The root cause is an unescaped tarball path or filename that, when containing shell metacharacters, allows an attacker to inject arbitrary commands. This is particularly relevan...

CVE-2026-78409

A flaw in util-linux 's X-mount.subdir mount option allows a local unprivileged user to escape the intended subdirectory and attach an arbitrary host path at the intended mountpoint. On Linux 6.15 and later , the option takes a detached-tree fast path that calls open_tree() with AT_SYMLINK_NOFOLL...

CVE-2026-78410

util-linux is affected by a flaw in how restricted bind mounts are handled. The source path taken from /etc/fstab is not pinned before the privileged mount(8) call, allowing a local unprivileged user who can replace the authorized source or a writable ancestor to redirect the SUID mount to bind a...

CVE-2026-78408

util-linux nsenter --join-cgroup opens the target cgroup.procs file as root and leaves the file descriptor open across subsequent namespace, credential, and execve() transitions. Because the kernel evaluates later cgroup migrations against the credentials of the original open, a process in an att...

CVE-2024-7956

CVE-2024-7956 is an Incorrect Authorization (CWE-863) vulnerability in Rockwell Automation DataMosaix Private Cloud , versions 7.07 and prior . A threat actor with basic user privileges can gain unauthorized access to other users' projects and modify or delete them. The CVSS v3.1 base score is 8....

CVE-2026-82293

Kibana's machine learning feature is affected by an Incorrect Authorization flaw (CWE-863) that allows an authenticated user to invoke machine learning functionality beyond their authorization scope, leading to unauthorized cluster resource consumption with low availability impact. The vulnerabil...

CVE-2026-78588

Filebeat (Elastic) is affected by an uncontrolled resource allocation vulnerability (CWE-770) in its HTTP ingestion endpoint . An attacker with network access to this endpoint can send specially crafted compressed requests that exhaust the memory of the Filebeat process, causing a denial of servi...

CVE-2026-78587

Fleet Server (Elastic) contains an Incorrect Authorization (CWE-863) flaw where session ownership is not correctly verified during multi-part data upload operations. This allows any authenticated agent to interfere with active upload sessions belonging to other enrolled agents, resulting in a den...

CVE-2026-78586

Kibana (Elastic) is vulnerable to unbounded memory allocation (CWE-770) that can cause a denial of service. An authenticated user with low-level privileges can submit a specially crafted request causing Kibana to consume unbounded memory, rendering it unavailable to all users. Affected versions: ...

CVE-2026-78584

CVE-2026-78584 is an Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature that allows an authenticated user with Osquery live-query privileges to determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access. The vulnerability affects...

CVE-2026-78591

CVE-2026-78591 is a Path Traversal vulnerability (CWE-22) in the Kibana Fleet feature that allows a low-privileged user to manipulate a subsequent action by a higher-privileged user , resulting in unauthorized deletion of resources , including accounts with elevated privileges. The affected confi...

CVE-2026-78590

A Path Traversal (CWE-22) vulnerability in the Kibana Fleet feature allows a low-privileged user with Fleet Settings write access to manipulate subsequent administrative actions so they target unintended internal resources, leading to unauthorized deletion of privileged resources such as user acc...

CVE-2026-78599

Kibana Fleet feature is affected by a stored path traversal (CWE-22) that allows a low-privileged user with Fleet write access to cause a subsequent administrative delete action to act on unintended internal resources, resulting in availability impact . Affected versions are 8.0.0–8.19.17 and 9.0...

CVE-2026-78598

CVE-2026-78598 is an Incorrect Authorization (CWE-863) flaw in the Kibana machine learning feature. An authenticated user with machine learning job management privileges in a single Kibana space can cause a job's saved object to become accessible across all spaces in the instance, exposing data t...

CVE-2026-78594

Elastic APM Server is affected by an Improper Handling of Highly Compressed Data (CWE-409) vulnerability that causes a persistent denial of service . An authenticated user with write access to source map content can store specially crafted, highly compressed data that exhausts APM Server memory u...

CVE-2026-78604

CVE-2026-78604 is an incorrect permission assignment (CWE-732) in Elastic Agent on Windows systems installed in unprivileged mode . Resources used by the agent service are created with access controls broader than required, allowing a local user to replace binaries (CAPEC-642) and cause the servi...

CVE-2026-82955

In the unreleased development version of Eclipse aeriOS , the KrakenD instance within the API Gateway component had the disable_jwk_security parameter hard-coded to true with no Helm chart override. This disabled TLS certificate verification when KrakenD fetched the JWKS used for bearer token val...

CVE-2026-78602

Elastic Maps Server is affected by a path traversal (CWE-22) vulnerability that allows an unauthenticated network attacker to read files outside the server's intended content directory, resulting in information disclosure . The vulnerable versions are 8.19.11 through 8.19.18 , 9.3.0 through 9.4.3...

CVE-2026-78601

Kibana 9.4.0–9.4.4 contains a Missing Authorization flaw in the Entity Store configuration operation. An authenticated user with elevated Kibana privileges can indirectly cause a background task to read Elasticsearch indices they are not authorized to access, with derived entity data then exposed...

CVE-2026-78600

Elastic Cloud on Kubernetes (ECK) is affected by an Incomplete Cleanup (CWE-459) flaw where authentication credentials persist after a cross-namespace association is denied by RBAC enforcement. This allows a low-privileged tenant to retain unauthorized read access to an associated Elasticsearch c...

CVE-2026-78609

Elastic Cloud on Kubernetes (ECK) versions 2.6.0 through 3.4.1 are affected by an Incorrect Authorization flaw (CWE-863) that enables Metadata Spoofing (CAPEC-690). An actor with limited Kubernetes permissions in one namespace can inject attacker-controlled certificate material into the Elasticse...

CVE-2026-76595

A vulnerability in advisor-backend involves multiple code paths that deserialize YAML using an unsafe full Loader, allowing instantiation of arbitrary Python objects via YAML tags. An unauthenticated remote attacker can exploit this by submitting specially crafted YAML input, achieving remote cod...

CVE-2026-12875

CVE-2026-12875 affects NLTK's RegexpTokenizer and represents a Regular Expression Denial of Service (ReDoS) via a caller-supplied regular expression. It is distinct from the sibling RecursiveDescentParser resource-consumption issue (GHSA-FF5C-CP5C-9WJF) and is tracked under GHSA-w3v8-gmh9-3wv7 . ...

CVE-2026-76594

A vulnerability in advisor-backend allows a network-adjacent unauthenticated attacker to exploit the /private/import_content/ endpoint, which lacks proper authentication and permission checks . An attacker can overwrite the global Advisor rule, resolution, and playbook catalogue. When combined wi...

CVE-2026-14255

A maliciously crafted IFC file , when parsed by certain Autodesk products , can trigger an uncontrolled recursion flaw, causing the application to terminate unexpectedly and resulting in a denial-of-service . Exploitation is local and requires the victim to open the crafted file; no privileges ar...