Archive
24 June 2026
Vulnerabilities first published on this day (UTC), newest first.
127 results · Clear filters · Feed
-
Medium 5.4
Ghost: File Upload Content-Type Spoofing
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content typ…
-
Medium 5.3
Ghost Content API filter bypass reveals private fields
Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the …
-
Medium 5.5
Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.73.0 until 2.91.0, he LaTeX backend's handling of \includegraphics, \input, and \include commands lacked path containment val…
-
Medium 4.3CVE-2026-54686 Public exploit
Warp: DCS lifecycle hook spoofing can alter terminal session metadata
Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 until 0.2026.05.06.15.42.stable_01, Warp accepted certain state-mutating terminal lifecycle hooks from the PTY stream without verifying that the hooks were emitted by Warp's shell i…
-
Medium 4.3
AnythingLLM: Windows path containment bypass in document folder route
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, on Windows, the document folder listing route can accept an encoded absolute Windows path that resolves outside the in…
-
Medium 6.3
dm log: fix out-of-bounds write due to region_count overflow
In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to region_count overflow The local variable region_count in create_log_context() is declared as unsigned int (32-bit), but dm_sector_div_up() returns secto…
-
Medium 4.8
Frappe Framework 17.0.0-dev - Stored XSS in Tree View node label rendering
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.ui.Tree component
-
Medium 4.6
Frappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields rendering
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Number Card component.
-
Medium 4.6
Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_config
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to unsafe evaluation of user-controlled data in the Number Card component.
-
Medium 4.8
Frappe Framework 17.0.0-dev - Stored XSS in Notifications Events color rendering
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Notifications > Events panel.
-
Medium 4.8
Frappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result rendering
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the MultiSelectDialog component.
-
Medium 4.6
Frappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline rendering
A Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of untrusted input in the Form Dashboard headline renderer.
-
Medium 4.6
Frappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs rendering
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the File View breadcrumb renderer.
-
Medium 4.8
Frappe Framework 17.0.0-dev - Stored XSS in Desktop Icon label rendering
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Desk desktop icon renderer.
-
Medium 5.1
Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the dashboard-view component.
-
Medium 4.6
Frappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image rendering
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.get_avatar function.
-
Medium 4.6
Frappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule rendering
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev. An authenticated attacker with write access to Auto Repeat can persist HTML/JavaScript in reference_document using a whitelisted write path and trigger script exe…
-
Medium 4.6
Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering
A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input before generating HTML output in the Audit Trail component.
-
Medium 6.3
Missing Authorization Vulnerability in OpenText Access Manager
An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3.
-
Medium 4.2
Jenkins Zowe zDevOps Plugin has a missing permission check
A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capt…
-
Medium 4.2
Jenkins Zowe zDevOps Plugin has a CSRF vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing …
-
Medium 5.4
Jenkins Assembla Plugin has a missing permission check
A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password.
-
Medium 5.4
Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified username and password.
-
Medium 4.3
Jenkins FitNesse Plugin stores passwords unencrypted
Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system.
-
Medium 4.3
Jenkins Contrast Continuous Application Security Plugin missing permission checks
Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata.
-
Medium 4.3
Jenkins MCP Server Plugin missing a permission check
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.
-
Medium 5.4
Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers to have Jenkins connect to an attacker-specified URL using an attacker-specified username, API key, and service key.
-
Medium 5.4
Jenkins Contrast Continuous Application Security Plugin has a missing permission check
A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key.
-
Medium 5.4
Jenkins EC2 Fleet Plugin has a missing permission check
A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturi…
-
Medium 5.4
Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS…
-
Medium 4.3
Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs
An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored i…
-
Medium 5.4
Jenkins Gitee Plugin missing permission checks
Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.
-
Medium 5.4
Jenkins Gitee Plugin has a cross-site request forgery vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.
-
Medium 4.8
Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation
Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers a…
-
Medium 4.3
Jenkins Priority Sorter Plugin has a CSRF vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration.
-
Medium 4.3
Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations
Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values…
-
Medium 4.3
Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names
A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository used by a job, such as branch names, tag names, and revision metadata.
-
Medium 4.3
Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types
Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to instantiate types related to job or system configuration other than Pipeline step…
-
Medium 4.3
Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs
A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.
-
Medium 5.0
Jenkins Git client Plugin has an OS command injection vulnerability on agents
Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH wrapper script, allowing attackers able to control the name of a build's working directory to execute arbitrary operati…