2026-09-03 归档

今日共收录 1407 条安全情报，包含 491 个 CVE，487 篇安全通告，以及 120 篇研究论文。

← 返回归档列表

漏洞预警2026-09-02 发布INFO

Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the bu...

CVE-2026-84670

Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-09-02 发布INFO

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrar...

CVE-2026-84669

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-02 发布INFO

Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it ...

CVE-2026-84668

Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file throug

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-02 发布INFO

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an...

CVE-2026-84667

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data bi

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-02 发布INFO

Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing ...

CVE-2026-84666

Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history record

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-02 发布INFO

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` ...

CVE-2026-84665

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-02 发布INFO

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker...

CVE-2026-84664

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler d

历史摘要 · 未重新核验 · NVD

#cve #cwe-471 #cwe-494

漏洞预警2026-09-02 发布INFO

A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches.

CVE-2026-84663

A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and ear

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-09-02 发布INFO

Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an attacker-specified ...

CVE-2026-84662

Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding

历史摘要 · 未重新核验 · NVD

#cve #cwe-601

漏洞预警2026-09-02 发布INFO

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `waitForBuild` step when the `propagat...

CVE-2026-84661

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream bui

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-02 发布INFO

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled even whe...

CVE-2026-84660

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream bui

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-02 发布INFO

Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the ...

CVE-2026-84659

Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that co

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-02 发布INFO

Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing at...

CVE-2026-84658

Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a construc

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-02 发布INFO

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait...

CVE-2026-84657

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission w

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-02 发布INFO

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and...

CVE-2026-84656

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permiss

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-02 发布INFO

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control ...

CVE-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-09-02 发布INFO

In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting pub...

CVE-2026-84654

In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS

历史摘要 · 未重新核验 · NVD

#cve #cwe-472

漏洞预警2026-09-02 发布INFO

Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, all...

CVE-2026-84653

Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform pe

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-02 发布INFO

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to ...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-09-02 发布INFO

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting ...

CVE-2026-84651

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration d

历史摘要 · 未重新核验 · NVD

#cve #cwe-284