2026

An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) i

A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an ov

A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from th

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized iden

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the prevai

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstra

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Pre

Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1

DSpace open source software is a repository application which provides durable access to digital resources. From version

DSpace open source software is a repository application which provides durable access to digital resources. From version

DSpace open source software is a repository application which provides durable access to digital resources. Prior to ver

DSpace open source software is a repository application which provides durable access to digital resources. Prior to ver

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized iden

agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to

claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md wh

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pyca

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path fro

TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controll

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauth

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio loca

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpo

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a securit

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runt

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard e

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio control

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnera

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco

A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that ar

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineer

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering t

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering t

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering t

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering t

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering t

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering t

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remo

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary com

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename o

Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and versio

Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the J

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build en

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read per

Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configura

Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions us

Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins

Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on