Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.1In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses Sanitize possible addl_desc_ptr out-of-bounds accesCheck if you run itEPSS 0.31%Oct 29, 2025
- None0.0In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card In try_to_register_card(), the return valueCheck if you run itEPSS 0.21%Oct 29, 2025
- High7.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: transport_ipc: validate payload size before reading handle handle_response() dereferences the payload asCheck if you run itEPSS 0.15%Oct 29, 2025
- None0.0In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix null-deref in agg_dequeue To prevent a potential crash in agg_dequeue (net/sched/sch_qfqCheck if you run itEPSS 0.21%Oct 29, 2025
- Medium5.4A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attackCheck if you run itEPSS 0.24%Oct 29, 2025
- Medium5.4A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-speCheck if you run itEPSS 0.21%Oct 29, 2025
- Medium4.3A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored iCheck if you run itEPSS 0.27%Oct 29, 2025
- Medium4.3Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.Check if you run itEPSS 0.26%Oct 29, 2025
- Medium4.3Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permCheck if you run itEPSS 0.17%Oct 29, 2025
- Medium4.3Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.Check if you run itEPSS 0.17%Oct 29, 2025
- Medium4.3Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended ReadCheck if you run itEPSS 0.17%Oct 29, 2025
- Medium4.3Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users witCheck if you run itEPSS 0.20%Oct 29, 2025
- Medium4.3A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attackeCheck if you run itEPSS 0.25%Oct 29, 2025
- Medium4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specCheck if you run itEPSS 0.21%Oct 29, 2025
- High8.8Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrCheck if you run itEPSS 0.61%Oct 29, 2025
- Medium4.3A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.Check if you run itEPSS 0.25%Oct 29, 2025
- Medium4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL.Check if you run itEPSS 0.21%Oct 29, 2025
- Medium4.3A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.Check if you run itEPSS 0.29%Oct 29, 2025
- Medium4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server.Check if you run itEPSS 0.23%Oct 29, 2025
- Medium5.9Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property to an empty value, disabling a protection mechanism of the Java runtime.Check if you run itEPSS 0.32%Oct 29, 2025
- High7.1Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.Check if you run itEPSS 0.35%Oct 29, 2025
- Medium5.4A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code.Check if you run itEPSS 0.26%Oct 29, 2025
- Medium5.4Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information abouCheck if you run itEPSS 0.26%Oct 29, 2025
- High7.5Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a uCheck if you run itEPSS 0.47%Oct 29, 2025
- Medium4.3The Call Now Button – The #1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple funcCheck if you run itEPSS 0.27%Oct 29, 2025
Sort