In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log...
CVE-2026-84648
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source
#severity:high
共收录 5383 条相关情报。
← 返回所有主题In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093...
CVE-2026-84649
In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their...
CVE-2026-84645
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in indepen
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from...
CVE-2026-84650
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowin
In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins...
CVE-2026-84647
In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an...
CVE-2026-66362
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability...
CVE-2026-77180
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configura
BIG-IP has a vulnerability where an authenticated user of any role may be able to create...
CVE-2026-66842
BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts th
A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch(...
CVE-2026-78222
A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX wo
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled ...
CVE-2026-14199
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than z
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
CVE-2026-75931
### Impact `fast-uri` canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When `reso
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
CVE-2026-75975
### Impact `fast-uri` does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed liter
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
CVE-2026-75899
### Impact `fast-uri` decodes a hostname's percent escapes twice in a single `normalize()` or `resolve()` call: once du
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
CVE-2026-76172
### Impact `fast-uri` decodes percent-encoded characters in the scheme component with the legacy global `unescape()` an
NLTK: Default ENFORCE=False Disables All pathsec Security Controls
CVE-2026-62388
NLTK's pathsec.py security module defaults to ENFORCE=False (line 24), which means all 8 security validation functions o
Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
CVE-2026-76098
## Summary Mistune v3.3.2 is vulnerable to a Denial of Service (DoS) attack via uncontrolled recursion in the HTML rende
The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to...
CVE-2026-14982
The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validat
In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts...
CVE-2026-14957
In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not N
APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without...
CVE-2026-84485
APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing
FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController...
CVE-2026-84715
FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allow