CVE-2026-92135

Jenkins Coverage Plugin version 3.3358.v9487dde48783 and earlier is affected by a stored cross-site scripting (XSS) vulnerability. The plugin fails to validate the coverage results ID when a job configuration is submitted via the REST API , allowing an attacker with Item/Configure permission to i...

CVE-2026-92134

CVE-2026-92134 affects the Jenkins Warnings Plugin (versions 13.10258.va_17d49a_78c3b_ and earlier ). The plugin fails to validate the analysis results ID when a job configuration is submitted through the REST API , allowing an attacker with Item/Configure permission to inject a javascript: schem...

CVE-2026-92133

Jenkins GitLab Plugin (1.2149.vcfc32c82b_f7f and earlier) is vulnerable to a credential cache key collision . The plugin builds a GitLab API client for alternative token credentials using a cache key derived from the credentials ID alone , omitting the folder context in which the credentials are ...

CVE-2026-92132

Jenkins Gradle Plugin versions 2.19.1252.v15196b_5a_6e10 and earlier contain a vulnerability where the plugin requests build scan data from a build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration. An attacker able to control the bui...

CVE-2026-92130

Jenkins Pipeline: Multibranch Plugin versions 841.vec5b_9e1806ec and earlier do not set the appropriate context for credentials lookup in the resolveScm Pipeline step. This allows an attacker who already holds Item/Configure permission to access and capture credentials they are not otherwise enti...

CVE-2026-92131

Jenkins Pipeline: Groovy Libraries Plugin version 805.vfc79344957d and earlier contains a path traversal vulnerability. The library Pipeline step does not restrict the provided path to a relative path inside the SCM checkout and follows symbolic links to locations outside it. This allows attacker...

CVE-2026-92129

Jenkins Script Security Plugin versions 1415.v9a_f9b_3a_c253d and earlier fail to check calls from sandboxed scripts to methods added dynamically to a class at runtime. An attacker with LOW privileges (permission to define and run sandboxed scripts, including Pipelines) can exploit this to bypass...

CVE-2026-92127

CVE-2026-92127 affects the Jenkins Script Security Plugin in versions 1415.v9a_f9b_3a_c253d and earlier. The vulnerability stems from the plugin automatically approving classpath entries in an item configuration when a user with Overall/Administer permission copies the item or updates its configu...

CVE-2026-92128

The Jenkins Script Security Plugin (versions 1415.v9a_f9b_3a_c253d and earlier ) is vulnerable to a TOCTOU-style JAR approval bypass . The plugin downloads a URL-specified JAR file twice: it confirms user approval of the first download but loads the classpath entries from the second. An attacker ...

CVE-2026-92126

CVE-2026-92126 affects the Jenkins Script Security Plugin version 1415.v9a_f9b_3a_c253d and earlier. The root cause is that the plugin does not reject @Builder annotations whose builderStrategy member names an arbitrary class. This allows an attacker who has permission to define and run sandboxed...

CVE-2026-92125

Jenkins Script Security Plugin versions 1415.v9a_f9b_3a_c253d and earlier fail to reject the @GroovyASTTransformationClass annotation, which allows an attacker with permission to define and run sandboxed scripts (including Pipelines) to trigger an arbitrary AST transformation at compile time . Th...

CVE-2026-92124

Jenkins Script Security Plugin versions 1415.v9a_f9b_3a_c253d and earlier contain a sandbox bypass vulnerability. The root cause is a type-cast inconsistency: the plugin validates operations on individual elements read from a collection that a sandboxed script casts to another type, but performs ...

CVE-2026-92123

CVE-2026-92123 affects the Jenkins Script Security Plugin in versions 1415.v9a_f9b_3a_c253d and earlier . The vulnerability stems from the plugin's failure to intercept operations performed on a null receiver , including method calls, property and attribute accesses, and array accesses. An attack...

CVE-2026-92122

CVE-2026-92122 affects the Jenkins Script Security Plugin (versions 1415.v9a_f9b_3a_c253d and earlier). The root cause is that the plugin fails to check the method invoked through a proxy created when a sandboxed script coerces a value to an interface, specifically when the value inherits a metho...

CVE-2026-19941

BIND 9 's named resolver contains a flaw in its checkwildcard() function that may accept an inapplicable, out-of-zone NSEC record as proof that no wildcard exists. This allows an attacker positioned at the same or an upstream level of the zone name to mask the existence of a victim's wildcard rec...

CVE-2026-61590

djust is a library providing Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7 , its observability endpoints exposed live view/session state and a remote method-invocation surface (eval_handler). The root cause is that the local...

CVE-2026-19662

CVE-2026-19662 is a use-after-free bug in BIND 9's qpcache (query performance cache) component, specifically in the NOQNAME proof handling. An attacker operating an authoritative server for a DNSSEC-signed zone can induce a recursive resolver to abort by sending crafted answers in a particular se...

CVE-2026-19667

CVE-2026-19667 is a remote assertion failure in the BIND 9 named daemon, caused by a 16-bit length truncation in dns_ncache_add(). When an attacker-controlled authoritative server returns a negative answer of exactly 65536 bytes , the negative cache entry is stored as 0 bytes; reading that entry ...

CVE-2026-92364

itsourcecode Leave Management System 1.0 is affected by a SQL injection vulnerability in the file /module/employee/index.php, where manipulation of the ID argument allows an attacker to inject SQL commands. The attack can be initiated remotely and requires low privileges (authenticated access), w...

CVE-2026-81736

CVE-2026-81736 is a remote CPU denial of service in ISC BIND 9 . When a resolver has cached a tree of SVCB/HTTPS AliasMode records and receives a query for the root of that tree, it spends disproportionate CPU time constructing the response, leading to availability impact. Affected versions are 9...