CVE-2026-117622

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-117621

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-117620

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

CVE-2026-117619

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...

CVE-2026-117618

In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user...

CVE-2026-117616

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary...

CVE-2026-117617

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers...

CVE-2026-117614

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to...

CVE-2026-117615

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system...

CVE-2026-117612

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the "resolves-to" attribute during XStream deserialization...

CVE-2026-117613

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted "config.xml" files that can lead to, e.g., stored cross-site scripting XSS vulnerabilities...

CVE-2026-114349

When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit. The size is attacker-controlled, and the batch CRC does not...

CVE-2026-112375

An authenticated Kafka principal with no authorization grants not even ALTERCONFIGS can make a broker read a file or an environment variable from the broker host and return its contents. An IncrementalAlterConfigs or AlterConfigs request targeting a BROKER resource reaches the broker's...

CVE-2026-116593

Apache Kafka Connect has the /connector-plugins/connector-type/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime. An...

CVE-2026-115644

Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property. When operators isolate the admin REST API by explicitly configuring the "admin.listeners" property, REST...

CVE-2026-111551

Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, with no check against the bytes actually available. A small crafted input can therefore declare a very large size and force a multi-gigabyte...

CVE-2026-111496

Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next computed the next punctuation time as timestamp + intervalsMissed + 1 interval with no overflow check. A record with a timestamp at or near Long.MAXVALUE advances stream time to that value, so the next...

CVE-2026-111115

Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field. That count was bounded only by the outer request frame size socket.request.max.bytes; it was not checked against the...

CVE-2026-111108

Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most elements need several bytes, a request...

CVE-2026-111073

The broker-side PushTelemetry API KIP-714 validates only the compressed size of a client's metrics payload against telemetry.max.bytes default 1 MB before decompressing it. ClientTelemetryUtils.decompress then decompresses the payload with no limit on the decompressed output size, growing a heap...

CVE-2026-110985

A Kafka broker using SASL/OAUTHBEARER with the default validator sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator selects its implementation from configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the JWT signature. When that URL is unset the default and...

CVE-2026-110952

A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer iss claim is verified only when sasl.oauthbearer.expected.issuer is set. Wh...

CVE-2026-83525

Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTERACTION privilege to cause a denial of service controller process termination via a crafted...

CVE-2026-93536

A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code...

CVE-2026-93524

A buffer overread in CheckKeySyms in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server...

CVE-2026-93523

A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context...

CVE-2026-118510

A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or...

CVE-2026-93522

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context...

CVE-2026-116778

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

CVE-2026-116776

USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize in USB Test/src/driveinfo.cpp trusts DISKGEOMETRY.BytesPerSector returned by IOCTLDISKGETDRIVEGEOMETRY without checking wheth...

CVE-2026-47235

SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the "bcpapi.cpp" loop over the JSON "sockets" array uses "slotdata"sockets".Size" without bounding "gemidx" by "MAXGEMSLOTS", which is four in...

CVE-2026-93521

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context...

CVE-2026-59979

YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/template routes omit organization and permission checks. "authorizeCognito" in "apps/backend/src/middlewares/auth.ts" sets the...

CVE-2026-44179

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the "excerpt-include" macro does not properly escape the included page's title and executes "excerpt" content with the macro's rights. The title handling in...

CVE-2026-50542

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on "GET /layout/status/id" allow an authenticated user with any privileges to view the "status and metadata" of any layout,...

CVE-2026-118029

Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas awswrangler before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket. To remediate this issue, users...

CVE-2026-50543

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing authorization on "POST /displaygroup/criteria/displayGroupId" allows an authenticated user to send criteria updates to any display via "XMR". These...

CVE-2026-50539

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on "/notification/export/id" allows an authenticated user to download attachments from any notification, including...

CVE-2026-115402

OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service system crash via a race condition in the TCP connect path...

CVE-2026-93520

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context...

CVE-2026-93519

A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context...

CVE-2026-93518

An integer truncation issue in XkbResizeKeyType that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server...

CVE-2026-116078

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. doreaddata/5 in lib/bandit/http2/stream.ex keeps every DATA...

CVE-2026-50541

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on "GET /dataset/export/csv/id" allow an authenticated user to export data from any dataset, including datasets created by...

CVE-2026-52729

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on "PUT/DELETE /action/id" allow an authenticated user to modify or delete actions on any Layout. Exploitation requires the...

CVE-2026-59959

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or "ANMF" fram...

CVE-2026-93517

A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context...

CVE-2026-59185

identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on "POST /v1/workspaces/:workspaceid/projects/:projectid/github/connect/complete" endpoint in "internal/api/router.go" accepts "installationid" from the request body or...

CVE-2026-59179

OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, "@openhop/server" passes unauthenticated flow route parameters from "GET /api/flows/:id" and "DELETE /api/flows/:id" in "packages/server/src/routes.ts" to "FlowStore.filePath" in "packages/server/src/store.ts" without ...

MSC-2026-13170

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Package contains a binary file packed/obfuscated...