A stack-based buffer overflow vulnerability exists in the vCard parsing functionality of Alpine iLX-F511 devices. This flaw allows network-adjacent attackers to execute arbitrary code with root privileges if the target connects to a malicious Bluetooth device. Exploitation requires user interaction. The vulnerability stems from improper validation of user-supplied vCard data before copying it to a fixed-length stack buffer.
Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability where the restriction on deserializing certain nested configuration objects is not consistently enforced. This flaw allows attackers to bypass root element checks and potentially inject nested objects into the configuration.
A missing permission check vulnerability in Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, allows attackers with Overall/Read permission to access sensitive HTTP proxy configuration details such as server, port, user name, and no-proxy host list.
Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, contain a vulnerability in the HTTP endpoint used for creating the first user account. This endpoint does not verify whether the setup wizard has been completed, leading to a race condition. An unauthenticated attacker can exploit this flaw to create an administrator account during the initial user account replacement process.
Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability where HTTP Basic authentication requests, including those using an API token, can obtain a "remember me" cookie. This allows attackers who have obtained a user's API token to maintain access to Jenkins via the "remember me" cookie even after the API token is revoked or expires.
Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability in their file browser that improperly identifies file paths attempting path traversal. This flaw allows attackers with Overall/Read permission to access metadata such as names, sizes, and last modification times of files within the Jenkins home directory. Additionally, attackers with Item/Workspace permission can obtain the names of jobs that have a workspace on the same agent.
Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, contain a vulnerability that allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature. These warnings can be exploited by administrators to inject attacker-controlled data, potentially overriding existing user account information such as login passwords.
Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, contain a vulnerability that allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller. This behavior results in a cross-site scripting (XSS) vulnerability that could be exploited by attackers who control agent processes.
A cross-site scripting (XSS) vulnerability exists in Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier. The vulnerability arises because the URL of the link shown in the workspace browser for each file and directory is computed on the agent side, which can be exploited by attackers who control agent processes.
Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, contain a stored cross-site scripting (XSS) vulnerability due to improper escaping of tooltip text in the breadcrumb bar overflow menu entries. This flaw can be exploited by attackers who have Overall or Read permissions.
Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability in how symbolic links are checked during file extraction. The system only checks for symbolic links in the path before creating parent directories, not immediately before writing the file. This flaw allows attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system by exploiting symbolic links in artifacts.
Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have an HTTP endpoint that loads agents by name without validating the name. This flaw allows attackers with Overall/Read permission to load any config.xml file from the controller's file system as an agent configuration and overwrite arbitrary config.xml files when saving the agent, potentially leading to arbitrary code execution.
Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability where launch commands in older agent configurations are converted into launchers by the Command Agent Launcher Plugin without administrator approval. This flaw allows attackers with Agent/Configure permission to execute arbitrary code within the Jenkins controller JVM context.
Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability where symbolic links are followed when copying the directory of an item being renamed. This behavior allows attackers with Item/Create and Item/Configure permissions to read arbitrary files on the Jenkins controller file system.
Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability where item types in collections are not restricted after deserialization. This flaw allows attackers with access to POST config.xml API endpoints to submit crafted configuration files that can lead to stored cross-site scripting (XSS) vulnerabilities.
CVE-2026-103403 is an OS Command Injection vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor's AccessManager component. It allows an attacker with limited privileges to execute arbitrary commands and delete files by exploiting improper neutralization of special elements during audit rule deletion. The vulnerability has a high severity score of 8.8 and affects confidentiality, integrity, and availability.
A vulnerability in Apache Kafka brokers using SASL/OAUTHBEARER with the bundled JWKS-backed validator allows tokens with valid signatures but missing or incorrect issuer (iss) and audience (aud) claims to be accepted by default. This occurs because the issuer and audience checks are only enforced if explicitly configured. This can lead to acceptance of tokens minted by different issuers or lacking audience claims, potentially allowing unauthorized authentication.
The broker-side PushTelemetry API in Apache Kafka versions prior to 4.2.2, 4.3.1, and 4.4.0 validates only the compressed size of telemetry payloads before decompressing them. This allows an authenticated client to send a small compressed payload that decompresses to a very large size, consuming excessive broker heap memory. This can lead to OutOfMemoryError conditions, degrading or crashing the broker and potentially affecting cluster availability. The vulnerability is mitigated in Apache Kafka 4.2.2, 4.3.1, and 4.4.0 by enforcing a maximum decompressed size equal to telemetry.max.bytes, aborting decompression if exceeded.
An authenticated user in Grafana OSS and Enterprise 13.2 with the experimental kubernetesSsoSettingsApi feature enabled can read SSO client secrets and modify instance-wide SSO settings without proper authorization. This vulnerability arises from missing authorization checks. The feature toggle is disabled by default.
An integer underflow vulnerability exists in the DhcpMessageDecoder component of Juniper Networks Session Smart Router. This flaw allows an attacker with local network access to send a malicious DHCP reply that can cause information disclosure and denial of service conditions. The vulnerability has a CVSS score of 7.1, indicating high severity.