Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Authorization code injection in Apache CXF OpenID Connect Hybrid Flow (CVE-2026-57817)
Apache CXF fails to enforce validation of the `c_hash` (authorization code hash) parameter when operating in the OpenID Connect Hybrid Flow, contrary to the requirements of the OpenID Connect Core 1.0 specification. W...
Fixed in 4.2.3; 4.1.8; 3.6.12
CSRF and SSRF in Eclipse GlassFish DownloadServlet leaks admin token (CVE-2026-12605)
Eclipse GlassFish versions 8.0.x before 8.0.4 contain a combined CSRF and SSRF vulnerability in the Admin Console DownloadServlet component. Four ContentSource implementations (LogViewer, LogFiles, LBConfig, ClientStu...
Fixed in 8.0.4
Incorrect access control in VuFind controller permission processing (CVE-2026-52466)
A vulnerability in VuFind's controller-level permission processing allows remote attackers to execute functions blocked by access control. The `\VuFind\Controller\AbstractBase::validateAccessPermission` method fails t...
Fixed in 11.0.4
Sandbox escape to remote code execution in FrontMCP plugin-codecall (CVE-2026-67531)
The `codecall:execute` tool in `@frontmcp/plugin-codecall` exposes live host Zod schema instances to sandboxed scripts through `getTool()`. Because Zod v4 defines `_zod` as a non-configurable, non-writable own propert...
Fixed in 1.5.7
Unauthenticated RPC leading to command execution in Nuxt DevTools (CVE-2026-71319)
Nuxt DevTools exposes a bidirectional RPC channel over the Vite HMR WebSocket with no authentication, token, handshake, or origin check. The `updateOptions()` and `openInEditor()` methods bypass the `ensureDevAuthToke...
Fixed in 3.3.1
OS command injection in Google::Auth for Perl via credentials JSON (CVE-2026-66902)
Google::Auth versions before 0.06 for Perl execute an arbitrary command specified in an external_account credentials JSON file through an ungated `system($command)` call. The Pluggable subclass reads `credential_sourc...
Fixed in 0.06
Command injection in PraisonAI GitHub Actions Claude workflow via PR branch name (CVE-2026-48168)
The bundled Claude GitHub Actions workflow in PraisonAI embeds an attacker-controlled pull request branch name directly into a Bash run block without quoting or validation, enabling shell command injection. Any outsid...
Fixed in >= 4.6.40
Missing permission check in Jenkins SCM-Manager Plugin (CVE-2026-70435)
Jenkins SCM-Manager Plugin 1.11.1 and earlier does not perform a required permission check in an HTTP endpoint. An attacker with Overall/Read permission can exploit this to connect to an attacker-specified URL using a...
Fixed in 1.12.1
Cross-site request forgery in Jenkins SCM-Manager Plugin (CVE-2026-70434)
A cross-site request forgery (CSRF) vulnerability in the Jenkins SCM-Manager Plugin allows attackers to trigger connections to an attacker-specified URL using credentials IDs obtained through a separate method. Succes...
Fixed in SCM-Manager Plugin 1.12.1
Missing permission check in Jenkins External Workspace Manager Plugin (CVE-2026-70436)
Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (versions 1.4.0 and earlier) or performs an improper permission check (version 1.4.1) when providing access to externally...
Fixed in 1.4.2
Multiple vulnerabilities in Jenkins and Jenkins plugins (CVE-2026-70440)
The Jenkins project disclosed multiple security vulnerabilities affecting Jenkins core and several plugins, including deserialization filter bypass, path traversal, arbitrary file write, CSRF, missing permission check...
Fixed in Jenkins 2.576; Jenkins LTS 2.568.2; External Workspace Manager Plugin 1.4.2; HCL AppScan Plugin 1.8.4; Multijob Plugin 677.v7ffc23d6a_4c2; SCM-Manager Plugin 1.12.1; Webhook Secret Credentials Provider Plugin 32.v09c9b_522f0a_8
Arbitrary file write via symlink in tar extraction in Jenkins (CVE-2026-70427)
Jenkins 2.575 and earlier (LTS 2.568.1 and earlier) does not safely handle symbolic links with effectively empty names during extraction of `.tar` and `.tar.gz` archives. Attackers able to control agent processes can ...
Fixed in Jenkins 2.576; Jenkins LTS 2.568.2
Cross-site request forgery in Jenkins Multijob Plugin (CVE-2026-70432)
Multijob Plugin 669.v9d96a_d9c71b_0 and earlier does not require POST requests for a form validation endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. Attackers can exploit this flaw to execute...
Fixed in Multijob Plugin 677.v7ffc23d6a_4c2
Unicode username normalization bypass in Jenkins (CVE-2026-70429)
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, handles case-insensitivity inconsistently between user name storage and comparison: canonical IDs are lowercased, but comparisons use `String#equalsIgnoreCase`, whic...
Fixed in Jenkins 2.576; Jenkins LTS 2.568.2
Timing side-channel in Jenkins Webhook Secret Credentials Provider Plugin (CVE-2026-70437)
Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when validating webhook bearer tokens against expected values. This timing discrepancy ...
Fixed in 32.v09c9b_522f0a_8
Groovy script sandbox escape in Jenkins Multijob Plugin (CVE-2026-70431)
Multijob Plugin 669.v9d96a_d9c71b_0 and earlier exposes Groovy scripting features that do not integrate with the Script Security Plugin, bypassing sandbox controls. Attackers with Item/Create or Item/Configure permiss...
Fixed in Multijob Plugin 677.v7ffc23d6a_4c2
Deserialization filter bypass in Jenkins Remoting library (CVE-2026-70426)
In Remoting 3384.v60d89463d9e0 and earlier (except 3355.3357.v931d3c992987), the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation. This allows ...
Fixed in Jenkins 2.576; Jenkins LTS 2.568.2
EncryptInterceptor bypass in Apache Tomcat (CVE-2026-34486)
An error in the fix for CVE-2026-29146 allowed the EncryptInterceptor to be bypassed in Apache Tomcat, leaving sensitive data unencrypted in transit. This missing encryption of sensitive data poses a risk to deploymen...
Fixed in Apache Tomcat 11.0.21; Apache Tomcat 10.1.54; Apache Tomcat 9.0.117
Missing authorization in Easy Post Submission plugin for WordPress (CVE-2026-4431)
The Easy Post Submission plugin for WordPress contains a missing capability check on the `create_post()` function. The `rbsm_submit_post` AJAX action is registered for unauthenticated users via `wp_ajax_nopriv_rbsm_su...
Fixed in 2.4.0
Missing authorization to unauthenticated arbitrary media deletion in Multi Uploader for Gravity Forms (CVE-2026-5581)
The Multi Uploader for Gravity Forms WordPress plugin contains missing capability checks in the `plupload_ajax_delete_file()` function, registered via `wp_ajax_nopriv_gfmu_delete_file`. The nonce intended for CSRF pro...
Fixed in 1.1.9