CVE-2026-57xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

802 records · Page 6 of 9

• CVE-2026-57366: WordPress WPAdverts plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.1 versions.

  Updated 2026-07-02
• CVE-2026-57365: WordPress reCAPTCHA (v2 & v3) for Asgaros Forum plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hitesh Chandwani reCAPTCHA (v2 &amp; v3) for Asgaros Forum recaptcha-for-asgaros-forum allows DOM-Based XSS.This issue affects reCAPTCHA (v2 &amp; v3) for Asgaros Forum: from n/a through <= 1.1.0.

  Updated 2026-07-13
• CVE-2026-57364: WordPress Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More plugin <= 2.2.0 - Other Vulnerability Type vulnerability 6.5 Medium

  Improper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &amp; More better-payment allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &amp; More: from n/a through <= 2.2.0.

  Updated 2026-07-13
• CVE-2026-57363: WordPress ChatBot plugin <= 8.3.7 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot chatbot allows Stored XSS.This issue affects ChatBot: from n/a through <= 8.3.7.

  Updated 2026-07-13
• CVE-2026-57362: WordPress ChatBot plugin <= 8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions.

  Updated 2026-07-02
• CVE-2026-57361: WordPress Survey Maker plugin <= 5.2.2.5 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.

  Updated 2026-07-02
• CVE-2026-57360: WordPress eCommerce Product Catalog plugin <= 3.5.4 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.

  Updated 2026-07-02
• CVE-2026-57359: WordPress ReviewX plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in ReviewX <= 2.3.10 versions.

  Updated 2026-07-02
• CVE-2026-57358: WordPress Customize My Account for WooCommerce plugin <= 4.3.9 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.

  Updated 2026-07-02
• CVE-2026-57357: WordPress Search Atlas SEO plugin <= 2.6.6 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.

  Updated 2026-07-02
• CVE-2026-57356: WordPress MC Woocommerce Wishlist plugin <= 1.9.19 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.

  Updated 2026-07-02
• CVE-2026-57355: WordPress Classified Listing plugin <= 5.4.2 - Broken Access Control vulnerability 6.5 Medium

  Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions.

  Updated 2026-07-02
• CVE-2026-57354: WordPress JetReviews plugin <= 3.0.0.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions.

  Updated 2026-07-02
• CVE-2026-57353: WordPress Link Whisper Premium plugin <= 2.9.0 - Broken Access Control vulnerability 6.5 Medium

  Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.

  Updated 2026-07-02
• CVE-2026-57352: WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.0 - Broken Authentication vulnerability 4.8 Medium

  Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions.

  Updated 2026-07-02
• CVE-2026-57351: WordPress HandL UTM Grabber plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions.

  Updated 2026-07-02
• CVE-2026-57350: WordPress WP Debugging plugin <= 2.12.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.

  Updated 2026-07-02
• CVE-2026-57349: WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.17 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions.

  Updated 2026-07-02
• CVE-2026-57348: WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability 7.2 High

  Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions.

  Updated 2026-07-02
• CVE-2026-57347: WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerability 6.5 Medium

  Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions.

  Updated 2026-07-02
• CVE-2026-57346: WordPress Embed Privacy plugin <= 1.12.3 - Arbitrary File Deletion vulnerability 7.1 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Epiphyt Embed Privacy allows Path Traversal. This issue affects Embed Privacy: from n/a through 1.12.3.

  Updated 2026-06-29
• CVE-2026-57345: WordPress Internal Links Manager plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions.

  Updated 2026-07-02
• CVE-2026-57344: WordPress Classified Listing plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.

  Updated 2026-07-02
• CVE-2026-57343: WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions.

  Updated 2026-07-02
• CVE-2026-57342: WordPress ShortPixel Adaptive Images plugin <= 3.11.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions.

  Updated 2026-07-02
• CVE-2026-57341: WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.9.0 - Insecure Direct Object References (IDOR) vulnerability 6.5 Medium

  Unauthenticated Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 versions.

  Updated 2026-07-01
• CVE-2026-57340: WordPress Japanized For WooCommerce plugin <= 2.9.12 - Broken Access Control vulnerability 6.5 Medium

  Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions.

  Updated 2026-06-29
• CVE-2026-57339: WordPress Business Directory plugin <= 6.4.23 - Broken Access Control vulnerability 6.6 Medium

  Unauthenticated Broken Access Control in Business Directory <= 6.4.23 versions.

  Updated 2026-06-29
• CVE-2026-57338: WordPress ARForms plugin <= 7.1.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.

  Updated 2026-06-29
• CVE-2026-57337: WordPress Landing Page Builder plugin <= 1.5.3.5 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Landing Page Builder <= 1.5.3.5 versions.

  Updated 2026-06-29
• CVE-2026-57336: WordPress Jobify theme <= 4.3.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Jobify <= 4.3.2 versions.

  Updated 2026-06-29
• CVE-2026-57335: WordPress Ads by WPQuads plugin <= 3.0.3 - Broken Access Control vulnerability 6.5 Medium

  Subscriber Broken Access Control in Ads by WPQuads <= 3.0.3 versions.

  Updated 2026-07-01
• CVE-2026-57334: WordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerability 6.5 Medium

  Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.

  Updated 2026-06-29
• CVE-2026-57333: WordPress Link Whisper Free plugin <= 0.9.4 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 versions.

  Updated 2026-06-29
• CVE-2026-57332: WordPress Wallet System for WooCommerce plugin <= 2.7.6 - Broken Access Control vulnerability 7.1 High

  Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions.

  Updated 2026-06-29
• CVE-2026-57331: WordPress Paid Videochat Turnkey Site plugin <= 7.4.8 - Arbitrary File Deletion vulnerability 9.9 Critical

  Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versions.

  Updated 2026-06-29
• CVE-2026-57330: WordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions.

  Updated 2026-06-29
• CVE-2026-57329: WordPress WooCommerce Designer Pro plugin <= 1.9.34 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Subscriber Cross Site Scripting (XSS) in WooCommerce Designer Pro <= 1.9.34 versions.

  Updated 2026-07-01
• CVE-2026-57328: WordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions.

  Updated 2026-06-29
• CVE-2026-57327: WordPress MainWP plugin <= 6.1.1 - Broken Access Control vulnerability 6.3 Medium

  Subscriber Broken Access Control in MainWP <= 6.1.1 versions.

  Updated 2026-06-29
• CVE-2026-57326: WordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions.

  Updated 2026-06-29
• CVE-2026-57325: WordPress NanoMag theme <= 1.8 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.

  Updated 2026-06-26
• CVE-2026-57324: WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability 6.5 Medium

  Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.

  Updated 2026-06-26
• CVE-2026-57323: WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability 5.8 Medium

  Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.

  Updated 2026-06-26
• CVE-2026-57322: WordPress weMail plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affects weMail: from n/a through 2.1.2.

  Updated 2026-09-18
• CVE-2026-57321: WordPress H5P plugin <= 1.17.7 - Arbitrary File Deletion vulnerability 7.1 High

  Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.

  Updated 2026-06-29
• CVE-2026-57320: WordPress BEAR plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions.

  Updated 2026-06-29
• CVE-2026-57319: WordPress FOX plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.

  Updated 2026-06-26
• CVE-2026-57318: WordPress Site Reviews plugin <= 8.0.11 - Sensitive Data Exposure vulnerability 6.5 Medium

  Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.

  Updated 2026-06-26
• CVE-2026-57317: WordPress Simply Schedule Appointments plugin <= 1.6.12.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.

  Updated 2026-06-26
• CVE-2026-57316: WordPress GetGenie plugin <= 4.4.2 - Sensitive Data Exposure vulnerability 6.5 Medium

  Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.

  Updated 2026-06-26
• CVE-2026-57315: WordPress Blocksy Companion Pro plugin <= 2.1.45 - Remote Code Execution (RCE) vulnerability 8.5 High

  Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.

  Updated 2026-06-26
• CVE-2026-57314: WordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.

  Updated 2026-06-29
• CVE-2026-57313: WordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.

  Updated 2026-06-26
• CVE-2026-57312: WordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.

  Updated 2026-06-26
• CVE-2026-57311: Unrestricted Upload of File with Dangerous Type in Windu CMS 5.3 Medium

  Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.

  Updated 2026-07-29
• CVE-2026-57310: Weak password hashing in Windu CMS 6.3 Medium

  Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.

  Updated 2026-07-20
• CVE-2026-57309: Blind SQL Injection in Windu CMS 9.3 Critical

  A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.

  Updated 2026-07-20
• CVE-2026-57308: Apache Syncope: SQL injection vulnerability in Audit Events search 9.8 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are r

  Updated 2026-07-21
• CVE-2026-57307: A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL 4.2 Medium

  A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

  Updated 2026-06-24
• CVE-2026-57306: A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL using 4.2 Medium

  A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

  Updated 2026-06-24
• CVE-2026-57305: A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified us 5.4 Medium

  A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified username and password.

  Updated 2026-06-24
• CVE-2026-57304: A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specif 5.4 Medium

  A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password.

  Updated 2026-06-24
• CVE-2026-57303: Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the conf 7.1 High

  Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.

  Updated 2026-06-24
• CVE-2026-57302: Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permis 4.3 Medium

  Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

  Updated 2026-06-24
• CVE-2026-57301: Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to 8.8 High

  Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

  Updated 2026-06-24
• CVE-2026-57300: A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they 4.3 Medium

  A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.

  Updated 2026-06-24
• CVE-2026-57299: Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configu 4.3 Medium

  Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata.

  Updated 2026-07-06
• CVE-2026-57298: A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers to have Jenkins connect to an attacke 5.4 Medium

  A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers to have Jenkins connect to an attacker-specified URL using an attacker-specified username, API key, and service key.

  Updated 2026-06-24
• CVE-2026-57297: A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-speci 5.4 Medium

  A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key.

  Updated 2026-07-06
• CVE-2026-57296: Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowi 8.8 High

  Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution.

  Updated 2026-06-24
• CVE-2026-57295: A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-specified URL using at 5.4 Medium

  A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.

  Updated 2026-06-24
• CVE-2026-57294: A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL us 5.4 Medium

  A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.

  Updated 2026-06-24
• CVE-2026-57293: An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permiss 4.3 Medium

  An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins.

  Updated 2026-06-24
• CVE-2026-57292: A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to an attacker-specified URL using attacker- 5.4 Medium

  A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.

  Updated 2026-06-24
• CVE-2026-57291: Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attac 5.4 Medium

  Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.

  Updated 2026-06-24
• CVE-2026-57290: A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configurati 4.3 Medium

  A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration.

  Updated 2026-06-24
• CVE-2026-57289: Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authentic 4.8 Medium

  Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to capture the token.

  Updated 2026-06-24
• CVE-2026-57288: Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing u 3.7 Low

  Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name.

  Updated 2026-06-24
• CVE-2026-57287: Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, a 4.3 Medium

  Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.

  Updated 2026-06-24
• CVE-2026-57286: A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository 4.3 Medium

  A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository used by a job, such as branch names, tag names, and revision metadata.

  Updated 2026-06-24
• CVE-2026-57285: A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Ent 4.3 Medium

  A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.

  Updated 2026-06-24
• CVE-2026-57284: Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to in 4.3 Medium

  Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to instantiate types related to job or system configuration other than Pipeline steps.

  Updated 2026-06-24
• CVE-2026-57283: A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types related to job or system c 4.3 Medium

  A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types related to job or system configuration other than Pipeline steps through the Pipeline Snippet Generator.

  Updated 2026-06-24
• CVE-2026-57282: Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH wrapper script, allowing attackers able 5.0 Medium

  Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH wrapper script, allowing attackers able to control the name of a build's working directory to execute arbitrary operating system commands on the agent.

  Updated 2026-06-24
• CVE-2026-57281: Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sa 7.5 High

  Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.

  Updated 2026-09-07
• CVE-2026-57280: Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts 8.8 High

  Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.

  Updated 2026-06-24
• CVE-2026-57279: Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the p 6.0 Medium

  Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product.

  Updated 2026-08-10
• CVE-2026-57278: GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability 8.3 High

  GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. The Websocket server can accept v

  Updated 2026-07-02
• CVE-2026-57277: GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability 8.3 High

  GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. The Websocket server can accept v

  Updated 2026-07-02
• CVE-2026-57276: GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability 8.3 High

  GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. The Websocket server can accept v

  Updated 2026-07-02
• CVE-2026-57275: GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability 8.3 High

  GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. The Websocket server can accept v

  Updated 2026-07-02
• CVE-2026-57274: GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability 8.3 High

  GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. The Websocket server can accept v

  Updated 2026-07-02
• CVE-2026-57273: GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability 8.3 High

  GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. The Websocket server can accept v

  Updated 2026-07-02
• CVE-2026-57272: GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability 8.3 High

  GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. The Websocket server can accept v

  Updated 2026-07-02
• CVE-2026-57271: GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability 8.3 High

  GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. #### pause command index-out-of-b

  Updated 2026-07-02
• CVE-2026-57270: GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability 8.3 High

  GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. The Websocket server can accept v

  Updated 2026-07-02
• CVE-2026-57269: GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability 8.3 High

  GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. The Websocket server can accept v

  Updated 2026-07-02
• CVE-2026-57268: GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability 8.3 High

  GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. The Websocket server can accept v

  Updated 2026-07-02
• CVE-2026-57267: GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability 8.3 High

  GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. The Websocket server can accept v

  Updated 2026-07-02

Search a CVE ID or check dependency files →