CVE-2026-78222

NGINX JavaScript (ngx_http_js_module) is vulnerable to a NULL Pointer Dereference (CWE-476) when a malformed HTTP response received by ngx.fetch() is processed and trusted JavaScript reads Response.statusText, causing an NGINX worker crash . Exploitation requires control or influence over the fet...

CVE-2026-78689

NGINX JavaScript (njs) contains a heap-based buffer overflow (CWE-122) in the XML module's namespace prefix list parser, reachable via the xml.exclusiveC14n() method. Both the njs and QuickJS (qjs) engines are affected. With njs, the out-of-bounds write corrupts adjacent objects and crashes the N...

CVE-2026-66362

CVE-2026-66362 is a configuration injection vulnerability in the NGINX configuration generator component of NGINX Gateway Fabric . When NGINX Plus is configured as the data plane, user-supplied values from the AuthenticationFilter CRD (clientID, cookieName) or the clientSecret field of a referenc...

CVE-2026-77180

NGINX Ingress Controller is vulnerable to a configuration injection flaw (CWE-76) in its configuration generator. Multiple user-controllable Ingress annotation fields are written into the generated NGINX configuration without sanitization , allowing an authenticated attacker with Kubernetes API w...

CVE-2026-18329

NGINX JavaScript (njs) and QuickJS (qjs) engines contain an authentication/authorization bypass in the ngx_http_js_module . When a js_access handler performs asynchronous request body processing and an exception is thrown before an explicit denial is returned, the phase fails open , allowing unau...

CVE-2026-84670

Jenkins Performance Plugin versions 1015.v09ca_52b_3370e and earlier fail to restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller. An attacker with Item/Configure permission can leverage this to execute...

CVE-2026-84668

Jenkins SAML Plugin (versions 4.618.v441a_27fa_46d2 and earlier) is vulnerable to improper access control via Stapler data binding. The plugin's @DataBoundConstructor-annotated constructor writes the SAML identity provider metadata file to the Jenkins controller file system without checking for t...

CVE-2026-66842

CVE-2026-66842 affects F5 BIG-IP (all modules) and BIG-IQ Centralized Management , allowing any authenticated user to create administrative accounts via an undisclosed request to the Configuration utility (TMUI) . F5 classified the root cause as CWE-918 (Server-Side Request Forgery) . The vulnera...

CVE-2026-84669

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system. The vulnerability is rated CVSS 3.1: 8.8 (HIGH) with a network attack v...

CVE-2026-63020

CVE-2026-63020 is a CWE-451 (UI Misrepresentation of Critical Information) vulnerability in the BIG-IP Configuration utility web interface. An attacker can trick authenticated users into clicking malicious links, causing a spoofed error message to be reflected in the victim's browser session. Thi...

CVE-2026-84666

Jenkins Job Configuration History Plugin versions 1367.vc8fa_b_15101dc and earlier are vulnerable to improper access control via Stapler data binding . The plugin incorrectly uses the @DataBoundConstructor annotation on a constructor for its global configuration, which is not intended to be invok...

CVE-2026-84667

CVE-2026-84667 affects Jenkins ThinBackup Plugin 2.1.4 and earlier . The root cause is the use of the @DataBoundConstructor annotation, which allows Stapler to invoke @DataBoundSetter methods managing the plugin's backup configuration. This enables an authenticated attacker to redirect backup wri...

CVE-2026-84665

Jenkins SonarQube Scanner Plugin versions 2.18.3 and earlier do not restrict URL schemes for dashboard links generated from SonarQube scanner results, permitting the javascript: scheme. This leads to a stored cross-site scripting (XSS) vulnerability exploitable by attackers holding Item/Configure...

CVE-2026-84663

A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin (pipeline-groovy-lib) versions 798.v5cc688825312 and earlier stems from an HTTP endpoint that does not require POST requests, allowing attackers to delete shared library caches . The issue was reported ...

CVE-2026-84664

CVE-2026-84664 affects the Jenkins GitLab Plugin version 1.9.16 and earlier. The root cause is an improper use of Stapler's @DataBoundConstructor annotation on the constructor for the global GitLab connection configuration, which allows Stapler to invoke @DataBoundSetter-annotated methods and ove...

CVE-2026-84661

Jenkins Pipeline: Build Step Plugin version 599.v4b_67ea_11b_152 and earlier contains a missing permission check in the waitForBuild step. When the propagateAbort parameter is set to true, the plugin cancels the downstream build without verifying that the build's associated authentication holds I...

CVE-2026-84662

Jenkins LDAP Plugin (ldap) versions 807.809.vd3a_4e5e4ec98 and earlier suffer from an improper access control flaw that enables Server-Side Request Forgery (SSRF) . The plugin's use of Stapler's @DataBoundConstructor annotation on a constructor that connects to a specified URL allows attackers ca...

CVE-2026-84660

Jenkins Pipeline: Build Step Plugin (pipeline-build-step) 599.v4b_67ea_11b_152 and earlier contains a missing permission check that allows downstream builds to be canceled even when the triggering build's authentication lacks Item/Cancel permission on the downstream job. The issue is triggered wh...

CVE-2026-84658

Jenkins Script Security Plugin versions 1412.v7737b_3405f86 and earlier are affected by an improper access control vulnerability (SECURITY-3986). The plugin uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration but is not intended to be invoked by use...

CVE-2026-84659

Jenkins Script Security Plugin versions 1412.v7737b_3405f86 and earlier are affected by an improper access control vulnerability. A @DataBoundSetter annotated method controlling the "Force the use of the sandbox globally in the system" setting does not enforce a permission check, allowing an auth...

CVE-2026-84656

A missing Item/Read permission check in an HTTP endpoint of Jenkins 2.579 and earlier (and LTS 2.568.2 and earlier ) allows an attacker with Item/Read permission on at least one job to read build parameter names and values of other jobs they should not have access to. This is tracked as SECURITY-...

CVE-2026-84657

In Jenkins 2.579 and earlier (LTS 2.568.2 and earlier), the build CLI command with the -s flag does not check the Item/Cancel permission when canceling a build after the CLI client is interrupted. Because Jenkins merges duplicate build requests into a single queue item, an attacker holding only I...

CVE-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API. Attackers who can control map property names can inject arbitrary fields into JSON and Python API responses, leading to a low-impact integrity issue (CVSS ...

CVE-2026-84654

Jenkins (via the Stapler web framework) is affected by a form data binding flaw in versions 2.579 and earlier (LTS 2.568.2 and earlier ). The root cause is that Stapler's form data binding allows setting public static fields of the bound configuration object, enabling attackers with the ability t...

CVE-2026-84653

Jenkins versions 2.421 through 2.579 and LTS 2.426.1 through 2.568.2 contain an incorrect permission check in the Appearance configuration page (introduced in Jenkins 2.421). Attackers holding the Overall/Manage permission can modify Appearance configuration options that should be restricted to a...

CVE-2026-84652

CVE-2026-84652 is a session fixation vulnerability in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) . When a user authenticates via the "remember me" cookie, Jenkins does not rotate the session, allowing an attacker serving content on a sibling subdomain (e.g., evil.example.org for Jenkins ...

CVE-2026-84651

Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) contain an unsafe deserialization flaw in the REST API and CLI endpoints used to update agent configuration. An attacker holding Agent/Configure permission on one agent can specify a different agent's name in the submitted XML, overwriting that ...

CVE-2026-84650

Jenkins versions 2.579 and earlier and LTS 2.568.2 and earlier are affected by an unsafe deserialization flaw (SECURITY-4032). Fields declared transient are excluded from serialization but still read back during deserialization for backward compatibility with existing configuration files. Attacke...

CVE-2026-84649

CVE-2026-84649 (CVSS 8.8, HIGH) affects the Stapler web framework bundled in Jenkins 2.447–2.579 (LTS 2.452.1–2.568.2). An HTTP endpoint serving dynamically generated JavaScript resources embeds the user's CSRF token (crumb) as a string literal , allowing an attacker who controls a page on the sa...

CVE-2026-84648

CVE-2026-84648 is a stored cross-site scripting (XSS) vulnerability in the system log viewer of Jenkins 2.579 and earlier (LTS 2.568.2 and earlier). The root cause is the failure to escape log record metadata (source, level, and timestamp) before rendering, allowing attackers who control agent pr...

CVE-2026-84647

CVE-2026-84647 affects Stapler (the web framework used by Jenkins) in versions up to 2107.v8dfcb_e8ed317 (except 2088.2093.vd7c3e58008a_6), shipped in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier . The root cause is that Stapler's form data binding does not restrict the object types that ca...

CVE-2026-84646

Jenkins (versions 2.579 and earlier, LTS 2.568.2 and earlier) is affected by a lack of type restriction in XML deserialization , allowing an attacker with Overall/Read permission to create user objects by submitting crafted XML. The root cause is that user objects can appear as nested field value...

CVE-2026-84645

Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) contains a deserialization vulnerability (SECURITY-3972). Objects implementing PersistenceRoot—types that store configuration in independent top-level files such as global configuration and jobs—can appear as nested field values in user-submitte...

CVE-2026-18058

The mobile Smart Connect dashboard UI (referenced via Motorola support, with CNA from Lenovo PSIRT ) was vulnerable to manipulation by third-party apps . When combined with a phishing attack , this manipulation could lead to privilege escalation for an attacker within the system. The vulnerabilit...

CVE-2026-84838

CVE-2026-84838 is a command injection vulnerability in rpmuncompress , a component of the RPM package management toolset. The root cause is that archive filenames containing shell metacharacters are not properly escaped before being passed to shell command strings via popen() , allowing a local a...

CVE-2026-84837

A command injection vulnerability was identified in rpm , specifically in the gettarspec function used by rpmbuild -t*. The root cause is an unescaped tarball path or filename that, when containing shell metacharacters, allows an attacker to inject arbitrary commands. This is particularly relevan...

CVE-2026-78409

A flaw in util-linux 's X-mount.subdir mount option allows a local unprivileged user to escape the intended subdirectory and attach an arbitrary host path at the intended mountpoint. On Linux 6.15 and later , the option takes a detached-tree fast path that calls open_tree() with AT_SYMLINK_NOFOLL...

CVE-2026-78410

util-linux is affected by a flaw in how restricted bind mounts are handled. The source path taken from /etc/fstab is not pinned before the privileged mount(8) call, allowing a local unprivileged user who can replace the authorized source or a writable ancestor to redirect the SUID mount to bind a...

CVE-2026-78408

util-linux nsenter --join-cgroup opens the target cgroup.procs file as root and leaves the file descriptor open across subsequent namespace, credential, and execve() transitions. Because the kernel evaluates later cgroup migrations against the credentials of the original open, a process in an att...

CVE-2024-7956

CVE-2024-7956 is an Incorrect Authorization (CWE-863) vulnerability in Rockwell Automation DataMosaix Private Cloud , versions 7.07 and prior . A threat actor with basic user privileges can gain unauthorized access to other users' projects and modify or delete them. The CVSS v3.1 base score is 8....

CVE-2026-82293

Kibana's machine learning feature is affected by an Incorrect Authorization flaw (CWE-863) that allows an authenticated user to invoke machine learning functionality beyond their authorization scope, leading to unauthorized cluster resource consumption with low availability impact. The vulnerabil...

CVE-2026-78588

Filebeat (Elastic) is affected by an uncontrolled resource allocation vulnerability (CWE-770) in its HTTP ingestion endpoint . An attacker with network access to this endpoint can send specially crafted compressed requests that exhaust the memory of the Filebeat process, causing a denial of servi...

CVE-2026-78587

Fleet Server (Elastic) contains an Incorrect Authorization (CWE-863) flaw where session ownership is not correctly verified during multi-part data upload operations. This allows any authenticated agent to interfere with active upload sessions belonging to other enrolled agents, resulting in a den...

CVE-2026-78586

Kibana (Elastic) is vulnerable to unbounded memory allocation (CWE-770) that can cause a denial of service. An authenticated user with low-level privileges can submit a specially crafted request causing Kibana to consume unbounded memory, rendering it unavailable to all users. Affected versions: ...

CVE-2026-78584

CVE-2026-78584 is an Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature that allows an authenticated user with Osquery live-query privileges to determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access. The vulnerability affects...

CVE-2026-78591

CVE-2026-78591 is a Path Traversal vulnerability (CWE-22) in the Kibana Fleet feature that allows a low-privileged user to manipulate a subsequent action by a higher-privileged user , resulting in unauthorized deletion of resources , including accounts with elevated privileges. The affected confi...

CVE-2026-78590

A Path Traversal (CWE-22) vulnerability in the Kibana Fleet feature allows a low-privileged user with Fleet Settings write access to manipulate subsequent administrative actions so they target unintended internal resources, leading to unauthorized deletion of privileged resources such as user acc...

CVE-2026-78599

Kibana Fleet feature is affected by a stored path traversal (CWE-22) that allows a low-privileged user with Fleet write access to cause a subsequent administrative delete action to act on unintended internal resources, resulting in availability impact . Affected versions are 8.0.0–8.19.17 and 9.0...

CVE-2026-78598

CVE-2026-78598 is an Incorrect Authorization (CWE-863) flaw in the Kibana machine learning feature. An authenticated user with machine learning job management privileges in a single Kibana space can cause a job's saved object to become accessible across all spaces in the instance, exposing data t...

CVE-2026-78594

Elastic APM Server is affected by an Improper Handling of Highly Compressed Data (CWE-409) vulnerability that causes a persistent denial of service . An authenticated user with write access to source map content can store specially crafted, highly compressed data that exhausts APM Server memory u...