Class-name polymorphic deserialization in jackson-databind is insufficiently validated: the outer class in a type ID is checked, but classes named inside generic arguments (and array element types) are accepted even when they would be rejected as direct type IDs, letting an attacker instantiate arbitrary classes. Affected are com.fasterxml.jackson.core:jackson-databind 2.10.0 through 2.18.11, 2.19.0 through 2.21.7 and 2.22.0 through 2.22.3, plus tools.jackson.core:jackson-databind 3.0.0 through 3.1.7 and 3.2.0 through 3.2.3; releases before 2.10.0 are unaffected because PolymorphicTypeValidator did not yet exist, and the earlier CVE-2026-54512 fixes (2.18.8, 2.21.4, 3.1.4) do not remediate this bypass. The default-validator case needs no application-authored validator at all, and the advisory's PoC demonstrates that with Spring on the classpath and attacker-controlled XML, FileSystemXmlApplicationContext is reached through map-key discovery and ProcessBuilder.start() executes arbitrary commands under the application account; the issue carries a public reproducer and warrants the act_now priority label, although exploitation remains gated on the specific polymorphism configuration, available classpath gadgets and a reachable deserialization entry point.
Unauthenticated OS command injection in AVideo-Encoder before 8.1.0 gives remote attackers arbitrary command execution as the web-server user through the live-streaming endpoint view/videosListToLive.php. The endpoint requires only non-empty playlists_id and APISecret values, forwards APISecret without comparing it to any stored secret, and never applies the Streamer::isURLAllowed allowlist, so an attacker can point webSiteRootURL at an HTTP stub they control, have Login::run adopt the returned JSON as session state (self-granting isLogged and canStream), then return a video list whose videos[].path values are interpolated without escaping into ffprobe and ffmpeg commands run via exec. Successful exploitation discloses database and stored streamer credentials, permits upstream platform compromise, file modification and persistence as the web-server user, and can deny encoder service; the vendor fixed this in 8.1.0 and no public exploit code is confirmed in the supplied data, though the advisory includes a detailed working PoC recipe.
Unauthenticated PHP code injection in AVideo-Encoder before 8.1.0 allows a remote attacker to write arbitrary PHP into videos/configuration.php through install/checkConfiguration.php and execute it as the web-server user. The attack works only while videos/configuration.php is absent-the default on a fresh deployment or after the file is deleted or moved-and requires the attacker to supply a reachable database host, which they control, plus a systemRootPath containing index.php. Version 8.1.0 fixes the flaw; a public PoC reference exists and is not verified as working exploit code, and the decision label is act_now with CVSS 10.0.
Unauthenticated attackers can upload arbitrary files, including PHP, through the WordPress plugin Checkout Files Upload for WooCommerce in every version before 2.4.0 whenever the plugin's 'accepted file types' setting is left empty - which the plugin itself documents as the way to accept all files, so this is an expected configuration rather than an exotic misconfiguration. Code execution follows only where the web server actually runs PHP from the uploads directory; on hosts that block PHP execution there, the flaw is limited to stored malicious files without RCE. Scoring is 9.8 (AV:N/AC:L/PR:N/UI:N) with EPSS at 0.24% (15th percentile) and no public exploit identified at time of analysis, but the flaw is prioritized act_now given unauthenticated, no-interaction upload to potential RCE; the vendor has released a patch in 2.4.0.
Juniper Networks Session Smart Router exposes an insecure endpoint that runs as root and performs no authentication check, letting a remote attacker who can reach it obtain administrative privileges by passing crafted URL parameters. Per the CVSS vector the attack is network-reachable, unauthenticated (PR:N) and requires no user interaction, so severity is rated 9.8 - but exploitability is gated by deployment state: only devices that have not yet been onboarded to Mist or Conductor are exposed, and the endpoint becomes unreachable once onboarding completes. No KEV listing or public exploit reference appears in the supplied intelligence, so no public exploit identified at time of analysis; the vulnerability is nevertheless tracked as act_now priority because of the pre-auth root-level impact within the pre-onboarding window.
Unauthenticated remote command execution as root affects Juniper Networks Session Smart Conductor through its Salt-based AutomatedProvisioner: a crafted salt minion ID containing shell special characters is not neutralized before being used in an OS command. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, an attacker who can reach the Conductor's provisioning interface needs no credentials and no user interaction, and the injected commands execute with root privileges. No public exploit or CISA KEV entry is identified at time of analysis, but the 9.8 vendor-reported severity and the act_now priority label make reachable management interfaces a high-priority exposure.
PHP object injection in the Ultimate Member WordPress plugin through 2.13.1 allows unauthenticated remote attackers to pass untrusted serialized data into the plugin, carrying a CVSS 9.8 score and a vuln.today act_now priority. The assessed vector (AV:N/AC:L/PR:N/UI:N) confirms network reachability without authentication or user interaction, but the exact endpoint, parameter, or feature that reaches unserialize() is not described in the available sources. No public exploit was identified at time of analysis and no KEV entry is present in the supplied data; practical impact depends on whether a usable POP gadget chain exists in the plugin or the surrounding WordPress/PHP environment, and the high-priority signal rests on limited sourcing.
Remote code execution in che-machine-exec allows network-reachable attackers to execute commands inside containers the service can access when authentication is disabled, which the description identifies as the default. The service concatenates attacker-controlled username and namespace values from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c command without escaping, enabling shell command substitution via $(...) or backticks. The upstream fix is commit a78541c29e5f48fd59a49cf206bc0e507628bd23; no public exploit was identified at time of analysis, and the priority decision is act_now.
Unauthenticated remote command execution is possible on Dell PowerProtect Data Domain appliances running Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, or LTS2026 8.6.1.0 through 8.6.1.20 because of a stack-based buffer overflow (CWE-121). CVSS 9.8 reflects network reachability with no authentication or user interaction, and the independent assessment labels this a genuine high-priority issue rather than a high-score-but-low-risk case. No public exploit was identified at time of analysis, but the act_now priority and pre-auth network vector mean externally reachable appliances should be treated as urgent.
Remote, unauthenticated attackers can obtain exposed credentials from Dell PowerProtect Data Domain appliances running Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, or LTS2026 8.6.1.0 through 8.6.1.20 because hard-coded cryptographic key material is present in the affected firmware. Exploitation requires network reachability to the appliance and results in access bounded by the privileges of the compromised user, not guaranteed administrative control. No public exploit code or CISA KEV entry is identified in the available data, but the 9.8 CVSS score and act_now priority reflect a genuine high-priority credential-exposure risk; the exact key-to-credential mechanism is not described.
Unauthenticated remote attackers can create privileged accounts on Dell PowerProtect Data Domain appliances running Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, or LTS2026 8.6.1.0 through 8.6.1.20, potentially taking complete control of the system. The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-862 missing authorization, with the vendor describing it as an improper authentication issue leading to privileged account creation. No public exploit code has been identified in the supplied intelligence at time of analysis, but the vuln.today decision label is act_now and Dell recommends upgrading at the earliest opportunity.
Improper authentication in Dell PowerProtect Data Domain allows remote unauthenticated attackers to bypass authentication and execute arbitrary commands with root privileges, giving complete control of the appliance. Affected systems are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. No public exploit has been identified at time of analysis, but the CVSS vector indicates no privileges or user interaction are required; exploitation is limited by whether an attacker can reach the appliance's remotely accessible interface.
Unauthenticated arbitrary file upload in the Contact Manager plugin for WordPress through 9.1.2 can escalate to remote code execution, but only on Apache servers running libapache2-mod_php and only if the attacker retrieves the uploaded .phar file within the brief window before the plugin unlinks it. The bypass uses a filename ending in a trailing dot, causing the extension-derivation check to return an empty string and pass the blacklist, after which sanitize_file_name() strips the dot and restores the .phar suffix on disk. Vuln.today priority is act_now; no public exploit code has been identified at time of analysis.
Unauthenticated attackers can upload arbitrary files - including PHP scripts - through the piereg_file_upload AJAX handler in the Pie Register Premium WordPress plugin in every version up to and including 3.8.4.0, and the server returns the generated destination filename in its response, handing the attacker the exact URL needed to trigger the uploaded file and potentially achieve remote code execution. The upload path enforces neither a nonce nor a capability check, and the results of wp_check_filetype/wp_check_filetype_and_ext are never inspected before move_uploaded_file() runs, so the type filter provides no effective barrier. No KEV entry or public exploit reference was supplied with this record; however, the vulnerability.today decision label is act_now and the independently assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), with the practical limit on full RCE being whether the target upload directory is web-accessible and executes PHP.
Unauthenticated WordPress account takeover in the Jupiter X Core plugin (all versions up to and including 4.61.0) allows a remote attacker to be logged in as the site's administrator through the Raven forms Twitter/X social login handler. After exchanging the visitor's oauth_verifier for an access token, the handler never calls setOauthToken() to rebind the TwitterOAuth client, so the follow-up account/verify_credentials call is still signed with the site operator's stored Access Token and Secret; the plugin then resolves a local WordPress user by the X application owner's email and issues a session with wp_set_auth_cookie(). Exploitation requires that the Twitter/X social login feature be enabled and configured with the operator's X credentials, but once it is, the attack needs no authentication and no user interaction (CVSS 3.1 base 9.8, decision label act_now); no public exploit was identified at time of analysis.
OS command injection in Topluyo Desktop for Linux before 2026.9.2410 lets an unauthenticated attacker who controls a URL opened in the application execute arbitrary operating-system commands with the victim user's privileges. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (9.6), so exploitation requires the victim to open the crafted link but then crosses from the app into the OS with high confidentiality, integrity, and availability impact. The vendor advisory identifies 2026.9.2410 as the fix; no public exploit is identified at time of analysis, and the supplied priority label is act_now.
SQL injection in Dell PowerProtect Data Domain Management Center allows a remote attacker holding a low-privileged authenticated session to execute arbitrary SQL within the console and, because the assessed scope is changed (S:C), cross the console boundary to gain unauthorized access to the managed Data Domain systems. Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; the flaw is rated 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) and is tracked with an act_now priority. No public exploit code was identified at time of analysis and there is no CISA KEV entry, but vendor fixes are available and the required credentials are the only barrier, so consoles reachable from untrusted networks should be updated promptly.
Missing authorization in Dell PowerProtect Data Domain Management Center (DDMC) allows an authenticated low-privileged, network-positioned user to invoke operations that should be restricted, with high integrity and availability impact on managed Data Domain systems and no confidentiality impact. The affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; the CVSS 3.1 score is 9.6 with scope changed. No public exploit identified at time of analysis, and the vulnerability is prioritized act_now.
Remote code execution in EagleCloud Aquila on-premises deployments through 2.6.7.2 allows authenticated low-privileged attackers to inject and execute arbitrary code through the Pigeon MFA service. The flaw is rated CVSS 9.4 and assessed as network-reachable with no user interaction, so a valid low-privileged account is the main prerequisite. No CISA KEV entry or public exploit code was identified at time of analysis; the vuln.today decision label is act_now given the high impact and limited authentication requirement.
Unauthenticated remote attackers can overwrite FearlessCMS content, plant persistent JavaScript on public pages, and enumerate and read host files through five leftover debug/test scripts in admin/ that perform privileged operations with no login check, no CSRF token, and no path validation. The anonymous entry point depends on the deployment mode: on the project's default Docker setup, which runs PHP's built-in development server, router.php tests an unnormalized admin URI prefix while the filesystem still resolves dot segments, so a request to /./admin/... is executed directly instead of being routed through the admin login gate. The issue is fixed in 0.1.4, the GitHub advisory publishes proof-of-concept request sequences with observed results, and there is no CISA KEV listing indicating active exploitation at time of analysis.
Authenticated administrators on Wing FTP Server can escape the server's configured base folder by adding user directories through the administrative scripting interface, because the product fails to verify that a user's base folder remains within bounds. Successful abuse gives the attacker arbitrary file writes with the privileges of the FTP process, and where the service was started with sudo as described in the vendor installation guide, files land as root, making remote code execution at root level realistic. The issue is rated 9.4 (CVSS 4.0) and carries an act_now priority from CERT-PL reporting, but exploitation requires a pre-existing administrator account (PR:H) and no public exploit code has been identified at time of analysis. Fixed in version 8.2.6.
The Java RMI service exposed by Tactis NoviGest Desktop App accepts remote method invocations on critical functions without verifying the caller, letting a network-positioned attacker reach stored credentials and issue arbitrary SQL against the application's PostgreSQL backend. Because the database account the application uses is described as holding elevated privileges, the SQL access can be chained into operating system command execution on the server, taking over confidentiality, integrity and availability. The defect is rated 9.4 under CVSS 4.0 and flagged act_now by vuln.today based on severity and breadth of impact, but no public exploit code has been identified at time of analysis and no CISA KEV listing exists; the practical barrier is network reachability to the RMI port, since a service bound to localhost or shielded by firewall rules is not remotely abusable. Note that the authentication requirement is not consistently described across sources - the narrative states critical RMI methods lack authentication, while the CVSS 4.0 vector asserts PR:L - so the exact precondition should be confirmed with the vendor.
Unauthenticated remote attackers can pull a ZIP of the Signal K Server log/config directory from the /skServer/ziplogs route in every signalk-server release before 2.33.0, and that archive contains security.json with the server's HS256 JWT signing key. Possession of the secretKey lets an attacker forge administrator tokens or create a persistent admin account and then authenticate through the normal login flow, yielding full control over NMEA routing, plugin configuration and alarms on affected installations, including vessel deployments. The endpoint was confirmed reachable without credentials on a live signalk-server 2.32.0 instance and roughly 66 potentially affected servers were visible to Shodan at disclosure; no public exploit identified at time of analysis, and the vendor addressed the issue in 2.33.0 by placing the route behind admin middleware.
Blind SQL injection in the WordPress plugin FunnelKit Automations (wp-marketing-automations) through version 3.8.5.2 lets remote attackers pass crafted SQL through a plugin input and infer database contents, exposing WordPress user credentials, session tokens and stored marketing/automation data. The vulnerability carries a 9.3 vendor-side CVSS score, while the independent assessment scores it as scope-unchanged with high confidentiality impact only (no integrity or availability effect); because the sources do not name the vulnerable parameter, AJAX action or REST route, the unauthenticated (PR:N) rating cannot be confirmed from the description, and WordPress plugin SQLi flaws are frequently limited to low-privilege authenticated roles - verifying that prerequisite is the decisive exposure question. No public exploit code has been identified at time of analysis, but the issue is flagged act_now priority and a public PoC reference may appear quickly given the plugin's wide install base.
Unauthenticated SQL injection in the Crowd Favorite DXP ToolKit WordPress plugin through version 2.0.1 allows remote attackers to read data from the underlying database, with the supplied assessment rating confidentiality impact as high and integrity and availability impact as none. The vulnerable endpoint or injectable parameter is not described in the available sources, and no public exploit code is identified at time of analysis. The vuln.today decision label is act_now, so remediation should be prioritized.
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthenticated network peers corrupt the rpc-server stack by advertising RDMA support in the HELLO message and sending up to 256 KiB into a 1-byte stack variable, crashing the server or potentially enabling code execution. The input CVSS 4.0 score is 9.2 Critical and the vuln.today decision is act_now, but exploitation requires the opt-in llama.cpp rpc-server to be running with the non-default RDMA transport and reachable from the attacker, which is reflected in the independent CVSS 3.1 assessment as AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified in the provided intelligence at time of analysis, and the vendor fix is available in build b11865.
Remote code execution as root in Sophos UTM (SG UTM) affects all versions when the email proxy is used with scanning enabled; unauthenticated network attackers can exploit a path traversal flaw, but must win a race condition by sustaining repeated attacks for several minutes. The product is end-of-life and requires a manual patch, so exposure persists until an operator actively installs the vendor fix. No public exploit has been identified at time of analysis, and the priority decision is act_now based on the vendor report and assessed impact.
Blind SQL injection in the Futurum Software User Authentication Module allows unauthenticated remote attackers to send crafted HTTP requests to private-area endpoints that the deployed WAF fails to filter, exposing the full database structure and sensitive customer records including PII. The root cause is user-supplied input that reaches database queries without adequate validation or sanitisation, compounded by an incorrect WAF configuration that lets the protection layer be bypassed rather than serving as a compensating control. No public exploit code has been identified at time of analysis, but the issue carries an act_now priority label and a CVSS 4.0 base score of 9.1, and the affected version range is not enumerated in the available data.
Dell PowerProtect Data Domain Management Center can be coerced into granting elevated privileges to a remote attacker who already holds a low-privileged authenticated account, because the product performs an authentication decision on a spoofable identity attribute rather than a verified one. Affected releases are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The impact does not stop at the management appliance: the scope change in the assessed vector (S:C) reflects that a successful escalation can reach other managed Data Domain systems, and vendor-published fixes exist, so the priority decision is act_now; no public exploit code and no CISA KEV entry were identified at time of analysis.
AI Gateway Payload Processing allows an authenticated tenant to submit another tenant's model identifier, causing the service to inject the victim's LLM API keys and consume the victim's model resources and quotas; CVSS 3.1 score is 9.1 with scope change and high confidentiality impact. The flaw is CWE-639 (Authorization Bypass Through User-Controlled Key) and requires a valid tenant account plus knowledge or guessing of the target model identifier. No public exploit identified at time of analysis, but the act_now priority label reflects the critical cross-tenant key exposure.
Echo's Proxy middleware can forward later HTTP requests straight to the configured upstream without invoking Echo's router or route-specific middleware after a client WebSocket upgrade is rejected by that upstream with an ordinary keep-alive response. This affects Echo v4 releases from 4.0.0 through 4.16.0 and v5 releases from 5.0.0 through 5.4.0, and can let unauthenticated remote attackers reach upstream resources that rely solely on Echo route-level authentication or authorization. Exploitation is conditional-it needs a reachable proxy route, an upstream that keeps the connection alive after rejecting the upgrade, and a target with no independent upstream authorization-so the independent assessment rates it high severity with high attack complexity; fixed releases are 4.16.1 and 5.4.1, and no public exploit or CISA KEV entry was identified at time of analysis.
Remote code execution in HCL BigFix AEX is reachable over the network with low attack complexity, but the CVSS vector requires a high-privilege account (PR:H), so an attacker must already hold privileged access to the product before exploiting the code-injection flaw (CWE-94). The scope change (S:C) indicates that successful exploitation can affect resources beyond the vulnerable component, with high confidentiality, integrity, and availability impact. No public exploit has been identified at the time of analysis, and the vendor advisory KB0134281 is the primary reference; the vuln.today decision label is act_now.
CVE-2026-117623 is one of several vulnerabilities fixed in the Jenkins 2026-10-28 security advisory, remediated only by upgrading Jenkins core to 2.588 or LTS 2.580.2. Its specific description is not present in the available sources: the advisory text enumerates CVE-2026-117612 through CVE-2026-117622 and truncates mid-sentence at SECURITY-4249 / CVE-2026-117622, so no CVSS score, CVSS vector, CWE, or trigger mechanism for CVE-2026-117623 is confirmed from the supplied data. No public exploit code is identified at time of analysis, the CVE is not noted as confirmed actively exploited (CISA KEV), and EPSS is not available; the root cause class and whether the same authenticated, permission-gated prerequisites that apply to its sibling issues apply here remain unverified.
Arbitrary file write on the Jenkins controller is possible in Jenkins 2.587 and earlier and LTS 2.580.1 and earlier when an authenticated user with Item/Configure permission archives artifacts concurrently, such as from parallel Pipeline branches. The extraction code checks for symbolic links only before creating parent directories and permits symlinks in artifacts to replace existing files or empty directories, leaving a race before the final write; successful exploitation can overwrite files outside the intended directory and lead to remote code execution. No public exploit was identified at time of analysis, and the vendor fixed the issue in Jenkins 2.588 and LTS 2.580.2.
Jenkins core 2.587 and earlier, plus LTS 2.580.1 and earlier, are the affected versions for the security batch fixed in Jenkins 2.588 and LTS 2.580.2, but the individual defect tracked as CVE-2026-117626 is not described in any of the source material available here - the supplied oss-security post and the linked Jenkins advisory 2026-10-28 both cut off at CVE-2026-117622 (SECURITY-4249). Exploitation status, CVSS, CWE and impact for this specific ID are therefore unverified: no CISA KEV entry, no confirmed working public exploit code, and no EPSS score were provided, so it should be treated as an unresolved mapping gap within an actively maintained advisory rather than as a characterized vulnerability. Analysts should read the full advisory page directly before assigning severity or exposure for this CVE. As a family characteristic of the same advisory, the sibling issues require an authenticated Jenkins account holding permissions such as Overall/Read, Item/Configure, View/Configure or Agent/Configure, and are explicitly noted as not exploitable anonymously.
Stored cross-site scripting in Jenkins core 2.587 and earlier and LTS 2.580.1 and earlier allows an attacker who already holds Item/Configure permission (or an equivalent */Configure permission such as View/Configure or Agent/Configure) to submit a crafted job config.xml through the POST config.xml API, where XStream deserialization of collection elements with unchecked types leads to script injection that executes in the browser of another user who later views the affected page. The actor cannot be anonymous and must be authorized to configure items, and exploitation requires victim interaction, so the practical impact is scoped to cross-site scripting rather than direct server compromise; Jenkins rates the issue qualitatively as High while publishing no CVSS base vector. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV. Enforcing Content Security Policy, available on Jenkins 2.539/LTS 2.541.1 and newer, mitigates the known impact, and the flaw is fixed in Jenkins 2.588 and LTS 2.580.2.
Deserialization of attacker-controlled XML in Jenkins 2.587 and earlier and LTS 2.580.1 and earlier can instantiate arbitrary types because the custom XStream converter does not apply the JEP-200 deserialization filter to classes referenced by the `resolves-to` attribute, potentially leading to remote code execution in the Jenkins controller JVM. Exploitation requires Overall/Read permission plus either a non-anonymous user account or a permission set that permits POSTing config.xml (Item/Configure, View/Configure, or Agent/Configure), so anonymous or account-less read access is insufficient. The issue is assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; no CISA KEV entry, EPSS score, or public exploit reference was provided in the available intelligence, so no public exploit is identified at time of analysis.
Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, expose an HTTP endpoint that loads agents by name without validating the name; an authenticated user with Overall/Read permission can thereby load any config.xml on the controller as an agent configuration. This can replace an existing agent or define a new one, and because the name declared in that file controls where the configuration is written, saving the agent overwrites that config.xml and can potentially lead to arbitrary code execution. The vendor fixed this in Jenkins 2.588 and LTS 2.580.2; no public exploit was identified at time of analysis.
Jenkins core 2.587 and earlier, along with LTS 2.580.1 and earlier, are covered by the 2026-10-28 Jenkins security advisory, and the EUVD record for this CVE points to advisory section SECURITY-4206; that section's text is not included in the material supplied here, so the specific defect, its trigger, and its exact permission prerequisites for CVE-2026-117625 cannot be confirmed from available data. What is confirmed for the advisory as a whole is that every listed issue requires an authenticated, non-anonymous Jenkins user holding a permission such as Overall/Read, Item/Configure, View/Configure, or Agent/Configure, and that several of the batch lead to remote code execution or stored cross-site scripting on the controller. No public exploit code or confirmed active exploitation is identified in the supplied sources, and the priority decision remains awaiting data, so treatment should be driven by the confirmed availability of the 2.588 / LTS 2.580.2 fix rather than by an exploitation signal.
Jenkins core 2.587 and earlier, along with LTS 2.580.1 and earlier, are affected by CVE-2026-117619, one of eight security issues addressed in the Jenkins advisory dated 2026-10-28 and fixed in Jenkins 2.588 and LTS 2.580.2. The per-CVE description for this specific identifier is not present in the supplied advisory excerpt, so neither the vulnerability class nor the precise attacker impact can be stated from the available data - only the affected scope and the fixed versions are confirmed. Every other entry in the same advisory requires an authenticated user holding specific Jenkins permissions (Overall/Read, Item/Configure, View/Configure, Agent/Configure, Item/Create) rather than anonymous access, which suggests a similar privilege prerequisite is likely here, but that remains unverified. No public exploit code and no CISA KEV entry are associated with this identifier in the supplied intelligence, and the priority decision is awaiting_data.
Jenkins core 2.587 and earlier and Jenkins LTS 2.580.1 and earlier are covered by the vendor's 2026-10-28 security advisory, which bundles fixes for several distinct flaws into Jenkins 2.588 and LTS 2.580.2; the identifier CVE-2026-117624 does not appear anywhere in the supplied advisory text, so its specific defect, prerequisites and severity could not be verified from the available sources. The sibling issues that are described are not anonymously reachable - they require an authenticated account plus a Jenkins permission such as Overall/Read, Item/Configure, View/Configure, Agent/Configure or Item/Create - and several of them can end in code execution in the controller JVM or in cross-site scripting. No public exploit code and no CISA KEV entry were identified for this identifier, no EPSS score was supplied, and the priority label is awaiting_data; the vendor advisory at https://www.jenkins.io/security/advisory/2026-10-28/ is the authoritative reference.
Arbitrary file read on the Jenkins controller affects Jenkins 2.587 and earlier and Jenkins LTS 2.580.1 and earlier when an authenticated user with both Item/Create and Item/Configure renames an item whose directory contains a symbolic link, causing the copy fallback to follow the link and disclose file contents. The direct impact is confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); disclosed secrets can enable a contingent escalation to remote code execution. No public exploit identified at time of analysis, and the supplied data contains no EPSS score or CISA KEV entry.
CVE-2026-117620 is one of the vulnerabilities covered by the Jenkins security advisory of 2026-10-28, fixed in Jenkins 2.588 and Jenkins LTS 2.580.2, but the supplied advisory text and oss-security post do not include a standalone description for this specific identifier. By contrast, the sibling CVEs detailed in the same bundle are permission-gated issues (XStream deserialization RCE under SECURITY-4125, stored XSS via crafted job config.xml under SECURITY-4225, command agent launcher RCE, symlink-based file read/write flaws, and an unvalidated agent-loading endpoint) and are not reported as actively exploited. The exact mechanism, impact, and required permissions for CVE-2026-117620 remain unconfirmed from the available sources; no public exploit code is identified for it and the decision label is awaiting_data.
Arbitrary code execution in the Jenkins controller JVM is possible for users holding Agent/Configure permission on Jenkins 2.587 and earlier and LTS 2.580.1 and earlier, because legacy agent launch commands carried over from Jenkins core are converted into Command Agent Launcher Plugin launchers without verifying that an administrator approved the command. The issue affects builds from Jenkins 2.86 / LTS 2.89.1 onward, where that launch functionality moved into the plugin, and is resolved only by upgrading to Jenkins 2.588 or LTS 2.580.2; no separate configuration workaround is documented for this specific issue. Exploitation requires an authenticated account with the elevated Agent/Configure permission, so the practical blast radius depends on how broadly that permission is delegated in a given installation; no public exploit code, EPSS score, or CISA KEV entry was identified at time of analysis, and the vulnerability remains at an 'awaiting data' prioritization state.
CVE-2026-117618 is one identifier in the Jenkins Security Advisory 2026-10-28 bundle, which fixes multiple Jenkins core vulnerabilities affecting Jenkins 2.587 and earlier and LTS 2.580.1 and earlier; the vendor-released patch is Jenkins 2.588 and LTS 2.580.2. The advisory excerpt available for this analysis enumerates SECURITY-4125/CVE-2026-117612 through SECURITY-4249/CVE-2026-117622 but does not include a description mapping SECURITY-4125 through SECURITY-4249 to the -117618 identifier, so the specific vulnerable component, attack vector, and required permissions for this CVE are unverified and must be read from the advisory page. No CISA KEV listing, no EPSS score, and no public exploit code were present in the supplied data, so exploitation status is no public exploit identified at time of analysis, and the vuln.today decision label remains awaiting_data. For the sibling issues in the same advisory, exploitation requires an authenticated foothold with configuration privileges (Overall/Read plus a non-anonymous account, Item/Configure, Agent/Configure, or Item/Create depending on the issue), and several of those siblings can lead to remote code execution on the controller.
Cross-site scripting in the Jenkins workspace browser lets an attacker who controls a build agent have script execute in the browser of a Jenkins user who opens the workspace listing for that agent. Only jobs whose workspace resides on an agent are affected, specifically Jenkins 2.587 and earlier and Jenkins LTS 2.580.1 and earlier, and the attacker must already control the agent process while a victim must actually view the workspace browser (assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N). The Jenkins advisory publishes no CVSS score or CWE for this item, there is no CISA KEV listing, no public exploit identified at time of analysis, and no EPSS data in the supplied sources.