Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 3 total.
Authenticated RCE via extension script sandbox escape in alf.io (CVE-2026-35482)
A sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system runs restricted JavaScript ...
Fixed in 2.0-M5-2606
Deserialization filter bypass in Jenkins Remoting library (CVE-2026-70426)
In Remoting 3384.v60d89463d9e0 and earlier (except 3355.3357.v931d3c992987), the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation. This allows ...
Fixed in Jenkins 2.576; Jenkins LTS 2.568.2
Privilege escalation via self-service REST API in Apache Syncope (CVE-2026-62183)
An improper privilege management vulnerability in Apache Syncope allows an authenticated user to escalate their own privileges via a REST API call. Under certain workflow adapter configurations, a user can assign them...
Fixed in 4.0.7; 4.1.2