Search: 1.2.4.4

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability in their file browser that improperly identifies file paths attempting path traversal. This flaw allows attackers with Overall/Read permission to access metadata such as names, sizes, and last modification times of files within the Jenkins home directory. Additionally, attackers with Item/Workspace permission can obtain the names of jobs that have a workspace on the same agent.

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, contain a vulnerability that allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller. This behavior results in a cross-site scripting (XSS) vulnerability that could be exploited by attackers who control agent processes.

A cross-site scripting (XSS) vulnerability exists in Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier. The vulnerability arises because the URL of the link shown in the workspace browser for each file and directory is computed on the agent side, which can be exploited by attackers who control agent processes.

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability where launch commands in older agent configurations are converted into launchers by the Command Agent Launcher Plugin without administrator approval. This flaw allows attackers with Agent/Configure permission to execute arbitrary code within the Jenkins controller JVM context.

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability where symbolic links are followed when copying the directory of an item being renamed. This behavior allows attackers with Item/Create and Item/Configure permissions to read arbitrary files on the Jenkins controller file system.

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability where item types in collections are not restricted after deserialization. This flaw allows attackers with access to POST config.xml API endpoints to submit crafted configuration files that can lead to stored cross-site scripting (XSS) vulnerabilities.

The broker-side PushTelemetry API in Apache Kafka versions prior to 4.2.2, 4.3.1, and 4.4.0 validates only the compressed size of telemetry payloads before decompressing them. This allows an authenticated client to send a small compressed payload that decompresses to a very large size, consuming excessive broker heap memory. This can lead to OutOfMemoryError conditions, degrading or crashing the broker and potentially affecting cluster availability. The vulnerability is mitigated in Apache Kafka 4.2.2, 4.3.1, and 4.4.0 by enforcing a maximum decompressed size equal to telemetry.max.bytes, aborting decompression if exceeded.

An integer underflow vulnerability exists in the DhcpMessageDecoder component of Juniper Networks Session Smart Router. This flaw allows an attacker with local network access to send a malicious DHCP reply that can cause information disclosure and denial of service conditions. The vulnerability has a CVSS score of 7.1, indicating high severity.

A vulnerability in Apache Kafka brokers using SASL/OAUTHBEARER with the default validator and no JWKS endpoint URL set allows acceptance of any structurally valid JWT without signature verification. This enables unauthenticated remote attackers to forge tokens asserting any principal, including superusers, gaining full cluster access. The issue affects brokers that enable SASL/OAUTHBEARER validation without configuring a JWKS endpoint URL or a custom signature-verifying validator. From Apache Kafka versions 4.2.2, 4.3.1, and 4.4.0, brokers fail to start if misconfigured, preventing insecure operation.

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability where the deserialization filter is not applied to classes referenced by the 'resolves-to' attribute during XStream deserialization. This could potentially allow unsafe deserialization of untrusted data.

A buffer overflow vulnerability exists in RandR ChangeProviderProperty requests in X.Org X Server versions before 2.1.25 and XWayland versions before 24.4.14. This flaw allows authenticated X clients to potentially crash the X server or execute arbitrary code within its context.

A heap buffer overflow vulnerability exists in the CopyArea CPU-to-FBO path of X.Org X Server versions before 21.1.15 and XWayland versions before 24.1.14. This flaw arises from mismatched size usage and can be exploited by authenticated X clients to crash the X server or potentially execute arbitrary code within the server context.

The npm package itsa-utils version 1.4.2 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

A cross-site scripting (XSS) vulnerability exists in the vue-i18n internationalization plugin for Vue.js versions from 9.0.0-beta.5 up to but not including 11.4.14 and from 12.0.0-alpha.1 up to but not including 12.0.0-alpha.5. When the escapeParameter (escapeParameterHtml in the Legacy API) option is enabled, named interpolation values are not properly escaped if both list and named values are supplied in the same translation call. This can allow attacker-controlled HTML markup injection, potentially leading to phishing or script execution when combined with other issues. The vulnerability is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than inserting them as text. An attacker who controls Dashboards language options can supply markup with event handlers, which execute in the hosting page origin when the fullscreen control is rendered. The label is reachable only when edit mode is enabled and viewFullscreen is present in the context-menu items. This issue is fixed in 4.2.3.

Highcharts JS versions from 1.0.0 up to but not including 4.2.3 contain a cross-site scripting (XSS) vulnerability in the Dashboards edit-mode sidebar. The issue arises because component language strings are parsed as HTML instead of being inserted as text, allowing an attacker who controls the Dashboards language configuration to inject malicious markup with event handlers. This code executes in the context of the hosting page when the edit-mode sidebar is opened and the affected labels render. The vulnerability is fixed in version 4.2.3.

Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file. (Chromium security severity: Medium)

Highcharts JS versions prior to 11.4.9, 12.6.1, and 13.1.1 contain a cross-site scripting (XSS) vulnerability. The issue arises because the credits.href property is assigned directly to the window location without validating the URL scheme. An attacker controlling the chart configuration can supply a javascript: URL, which executes script in the context of the hosting page when a user clicks the credits label. This vulnerability affects Highcharts and its related packages Highcharts Stock, Maps, and Gantt. The issue is fixed in versions 11.4.9, 12.6.1, and 13.1.1.

CVE-2026-118250 is a prototype pollution vulnerability in Highcharts JS, a JavaScript charting library. Versions from 6.1.0 up to but not including 11.4.9, 12.0.0 up to 12.6.1, and 13.0.0 up to 13.1.0 are affected. The flaw allows an attacker controlling series.keys and point data to manipulate the __proto__ property, assigning arbitrary properties to Object.prototype. This affects all JavaScript on the page without requiring user interaction beyond rendering the chart. The issue is fixed in versions 11.4.9, 12.6.1, and 13.1.0.