Export limit exceeded: 368126 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 368126 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (368126 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-84660 | 1 Jenkins Project | 1 Jenkins Pipeline Build Step Plugin | 2026-09-03 | 5.4 Medium |
| A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job. | ||||
| CVE-2026-84661 | 1 Jenkins Project | 1 Jenkins Pipeline Build Step Plugin | 2026-09-03 | 5.4 Medium |
| A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `waitForBuild` step when the `propagateAbort` parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job. | ||||
| CVE-2026-84664 | 1 Jenkins Project | 1 Jenkins Gitlab Plugin | 2026-09-03 | 5.4 Medium |
| Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators. | ||||
| CVE-2026-84665 | 1 Jenkins Project | 1 Jenkins Sonarqube Scanner Plugin | 2026-09-03 | 8 High |
| Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | ||||
| CVE-2026-84667 | 1 Jenkins Project | 1 Jenkins Thinbackup Plugin | 2026-09-03 | 7.1 High |
| Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups. | ||||
| CVE-2026-84668 | 1 Jenkins Project | 1 Jenkins Saml Plugin | 2026-09-03 | 8.8 High |
| Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user. | ||||
| CVE-2026-84669 | 1 Jenkins Project | 1 Jenkins Allure Plugin | 2026-09-03 | 8.8 High |
| A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system. | ||||
| CVE-2026-84670 | 1 Jenkins Project | 1 Jenkins Performance Plugin | 2026-09-03 | 8.8 High |
| Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller. | ||||
| CVE-2026-84671 | 1 Jenkins Project | 1 Jenkins File Parameter Plugin | 2026-09-03 | 8.8 High |
| Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution. | ||||
| CVE-2026-84673 | 1 Jenkins Project | 1 Jenkins Customizable Header Plugin | 2026-09-03 | 8.8 High |
| Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability. | ||||
| CVE-2026-84674 | 1 Jenkins Project | 1 Jenkins Xebialabs Xl Deploy Plugin | 2026-09-03 | 5.4 Medium |
| Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2026-85182 | 1 Lenve | 1 Vhr | 2026-09-03 | 7.5 High |
| vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body. | ||||
| CVE-2026-71403 | 1 Suse | 1 Rancher | 2026-09-03 | 6.1 Medium |
| A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim's account and inherited its role bindings. This issue affects Rancher: before 2.15.1. | ||||
| CVE-2026-71404 | 1 Suse | 1 Rancher | 2026-09-03 | 8.7 High |
| A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as `cluster-admin`, and revoke the permissions of every principal bound to it. The change persists after the malicious GlobalRole is deleted. This issue affects Rancher: before 2.15.1. | ||||
| CVE-2026-85100 | 1 2fastlabs | 1 Agent-squad | 2026-09-03 | 4.3 Medium |
| A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squad/typescript/src/orchestrator.ts of the component Streaming Agent Response Workflow. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-85021 | 1 Langgenius | 1 Dify | 2026-09-03 | 4.3 Medium |
| A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirect_url causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-84857 | 1 Sigoden | 1 Aichat | 2026-09-03 | 5.3 Medium |
| A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulation causes uncontrolled memory allocation. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-84839 | 1 Tsi-coop | 1 Tsi-dpdp-cms | 2026-09-03 | 5.3 Medium |
| A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.5.1 can resolve this issue. It is suggested to upgrade the affected component. | ||||
| CVE-2026-84437 | 1 Opencart | 1 Opencart | 2026-09-03 | 3.5 Low |
| A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address_1 results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-84423 | 1 Casdoor | 1 Casdoor | 2026-09-03 | 7.3 High |
| A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way. | ||||