Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 19 total.
Authenticated RCE via extension script sandbox escape in alf.io (CVE-2026-35482)
A sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system runs restricted JavaScript ...
Fixed in 2.0-M5-2606
Multiple vulnerabilities in Jenkins and Jenkins plugins (CVE-2026-70440)
The Jenkins project disclosed multiple security vulnerabilities affecting Jenkins core and several plugins, including deserialization filter bypass, path traversal, arbitrary file write, CSRF, missing permission check...
Fixed in Jenkins 2.576; Jenkins LTS 2.568.2; External Workspace Manager Plugin 1.4.2; HCL AppScan Plugin 1.8.4; Multijob Plugin 677.v7ffc23d6a_4c2; SCM-Manager Plugin 1.12.1; Webhook Secret Credentials Provider Plugin 32.v09c9b_522f0a_8
Arbitrary file write via symlink in tar extraction in Jenkins (CVE-2026-70427)
Jenkins 2.575 and earlier (LTS 2.568.1 and earlier) does not safely handle symbolic links with effectively empty names during extraction of `.tar` and `.tar.gz` archives. Attackers able to control agent processes can ...
Fixed in Jenkins 2.576; Jenkins LTS 2.568.2
Cross-site request forgery in Jenkins Multijob Plugin (CVE-2026-70432)
Multijob Plugin 669.v9d96a_d9c71b_0 and earlier does not require POST requests for a form validation endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. Attackers can exploit this flaw to execute...
Fixed in Multijob Plugin 677.v7ffc23d6a_4c2
Unicode username normalization bypass in Jenkins (CVE-2026-70429)
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, handles case-insensitivity inconsistently between user name storage and comparison: canonical IDs are lowercased, but comparisons use `String#equalsIgnoreCase`, whic...
Fixed in Jenkins 2.576; Jenkins LTS 2.568.2
Groovy script sandbox escape in Jenkins Multijob Plugin (CVE-2026-70431)
Multijob Plugin 669.v9d96a_d9c71b_0 and earlier exposes Groovy scripting features that do not integrate with the Script Security Plugin, bypassing sandbox controls. Attackers with Item/Create or Item/Configure permiss...
Fixed in Multijob Plugin 677.v7ffc23d6a_4c2
Deserialization filter bypass in Jenkins Remoting library (CVE-2026-70426)
In Remoting 3384.v60d89463d9e0 and earlier (except 3355.3357.v931d3c992987), the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation. This allows ...
Fixed in Jenkins 2.576; Jenkins LTS 2.568.2
Denial of service via session flow control bypass in Apache Qpid Proton Dotnet (CVE-2026-67553)
An authenticated attacker can exceed the session flow control incoming window in Apache Qpid Proton Dotnet, potentially leading to denial of service. The vulnerability exists in all versions through 1.0.0 and requires...
Fixed in 1.1.0
Pre-authentication stack overflow in Apache Qpid Proton Dotnet (CVE-2026-67552)
A pre-authentication attacker can exploit unbounded type nesting in Apache Qpid Proton Dotnet to trigger a StackOverflowError, potentially causing denial of service. No authentication is required to trigger this condi...
Fixed in 1.1.0
Denial of service via unbounded disposition range handling in Apache Qpid Proton-Dotnet (CVE-2026-67554)
An authenticated attacker can craft a disposition frame containing large or illegal ranges, causing excessive CPU usage due to naive range handling in Apache Qpid Proton-Dotnet. Successful exploitation leads to denial...
Fixed in 1.1.0
Resource exhaustion via uncapped transfer frames in Apache Qpid Proton Dotnet (CVE-2026-67555)
Apache Qpid Proton Dotnet did not enforce a maximum number of transfer frames per incoming delivery. An authenticated attacker could exploit this to cause excessive resource usage and a potential denial of service.
Fixed in 1.1.0
Pre-authentication denial of service in Apache Qpid ProtonJ2 (CVE-2026-67589)
A pre-authentication attacker can exploit improper type size/count handling in Apache Qpid ProtonJ2 to trigger excessive memory allocation, leading to potential denial of service. No authentication is required to expl...
Fixed in 1.2.0
Pre-authentication denial of service in Apache Qpid ProtonJ2 (CVE-2026-67588)
Apache Qpid ProtonJ2 contains a vulnerability in its symbol value caching mechanism that imposes no upper bound on cache growth. A pre-authentication attacker can exploit this to exhaust server resources, resulting in...
Fixed in 1.2.0
Pre-authentication stack overflow in Apache Qpid ProtonJ2 (CVE-2026-67590)
A pre-authentication attacker can exploit unbounded type nesting in Apache Qpid ProtonJ2 to trigger a StackOverflowError, potentially causing denial of service. Because the vulnerability is reachable before authentica...
Fixed in 1.2.0
Denial of service via session flow control bypass in Apache Qpid ProtonJ2 (CVE-2026-67591)
An authenticated attacker can exceed the session flow control incoming window in Apache Qpid ProtonJ2, violating protocol-level constraints. This can potentially lead to a denial of service condition on affected systems.
Fixed in 1.2.0
Uncontrolled resource consumption in Apache Qpid ProtonJ2 (CVE-2026-67592)
Apache Qpid ProtonJ2 did not enforce a maximum number of transfer frames per incoming delivery. An authenticated attacker could exploit this to cause excessive resource usage and potential denial of service.
Fixed in 1.2.0
Pre-authentication denial of service in Apache Qpid Proton-J (CVE-2026-66273)
Apache Qpid Proton-J contains a flaw in type size/count handling that allows a pre-authentication attacker to trigger excessive memory allocation. This can lead to a potential denial of service condition.
Fixed in 0.35.0
Pre-authentication resource exhaustion in Apache Qpid Proton-J (CVE-2026-66257)
Apache Qpid Proton-J contains a vulnerability in which symbol values are cached without bound, allowing a pre-authentication attacker to exhaust server resources. Successful exploitation results in denial of service.
Fixed in 0.35.0
Privilege escalation via self-service REST API in Apache Syncope (CVE-2026-62183)
An improper privilege management vulnerability in Apache Syncope allows an authenticated user to escalate their own privileges via a REST API call. Under certain workflow adapter configurations, a user can assign them...
Fixed in 4.0.7; 4.1.2