Total
410447 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-84348 | 1 Google | 1 Chrome | 2026-09-03 | N/A | 6.5 MEDIUM |
| Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-51788 | 2026-09-03 | N/A | 7.5 HIGH | ||
| An issue in cleverange_auth v.0.1.10 allows a remote attacker to cause a denial of service via the account_verification function and the accounts/models.py component | |||||
| CVE-2025-9189 | 1 Ni | 1 Dasylab | 2026-09-03 | N/A | 7.8 HIGH |
| There is an out of bounds write vulnerability due to improper bounds checking resulting in a large destination address when parsing a DSB file with Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DSB file. The vulnerability affects all versions of DASYLab. | |||||
| CVE-2026-84349 | 1 Google | 1 Chrome | 2026-09-03 | N/A | 8.3 HIGH |
| Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-84359 | 1 Google | 1 Chrome | 2026-09-03 | N/A | 3.1 LOW |
| Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-81267 | 1 Mozilla | 1 Firefox Mobile | 2026-09-03 | N/A | 5.4 MEDIUM |
| A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0. | |||||
| CVE-2026-84669 | 2026-09-03 | N/A | 8.8 HIGH | ||
| A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system. | |||||
| CVE-2026-84675 | 2026-09-03 | N/A | 7.4 HIGH | ||
| OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build. | |||||
| CVE-2026-84677 | 2026-09-03 | N/A | 5.4 MEDIUM | ||
| Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting. | |||||
| CVE-2026-84654 | 2026-09-03 | N/A | 5.4 MEDIUM | ||
| In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify public static fields of the configuration objects those forms are bound to, resulting in changes that apply globally to the Jenkins instance. | |||||
| CVE-2026-84672 | 2026-09-03 | N/A | 8.8 HIGH | ||
| Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a privileged group. | |||||
| CVE-2026-84668 | 2026-09-03 | N/A | 8.8 HIGH | ||
| Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user. | |||||
| CVE-2026-84663 | 2026-09-03 | N/A | 5.4 MEDIUM | ||
| A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches. | |||||
| CVE-2026-84670 | 2026-09-03 | N/A | 8.8 HIGH | ||
| Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller. | |||||
| CVE-2026-84676 | 2026-09-03 | N/A | 4.3 MEDIUM | ||
| Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. | |||||
| CVE-2026-84662 | 2026-09-03 | N/A | 4.3 MEDIUM | ||
| Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an attacker-specified URL. | |||||
| CVE-2026-84671 | 2026-09-03 | N/A | 8.8 HIGH | ||
| Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution. | |||||
| CVE-2026-84665 | 2026-09-03 | N/A | 8.0 HIGH | ||
| Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | |||||
| CVE-2026-84660 | 2026-09-03 | N/A | 5.4 MEDIUM | ||
| A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job. | |||||
| CVE-2026-84674 | 2026-09-03 | N/A | 5.4 MEDIUM | ||
| Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | |||||