Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84670 | high | 8.8 | No | Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached... | 2026-09-03 |
| CVE-2026-84669 | high | 8.8 | No | A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish A... | 2026-09-03 |
| CVE-2026-84668 | high | 8.8 | No | Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data bindi... | 2026-09-03 |
| CVE-2026-84667 | high | 7.1 | No | Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing atta... | 2026-09-03 |
| CVE-2026-84665 | high | 8.0 | No | Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner... | 2026-09-03 |
| CVE-2026-84664 | medium | 5.4 | No | Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowin... | 2026-09-03 |
| CVE-2026-84663 | medium | 5.4 | No | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attacker... | 2026-09-03 |
| CVE-2026-84662 | medium | 4.3 | No | Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers... | 2026-09-03 |
| CVE-2026-84661 | medium | 5.4 | No | A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `... | 2026-09-03 |
| CVE-2026-84660 | medium | 5.4 | No | A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the... | 2026-09-03 |
| CVE-2026-84654 | medium | 5.4 | No | In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier,... | 2026-09-03 |
| CVE-2026-84649 | high | 8.8 | No | In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 th... | 2026-09-03 |
| CVE-2026-84647 | high | 8.8 | No | In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier,... | 2026-09-03 |
| CVE-2026-84323 | medium | 5.3 | No | Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proce... | 2026-09-03 |
| CVE-2026-84324 | critical | 9.0 | No | Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via... | 2026-09-03 |
| CVE-2026-84325 | critical | 9.8 | No | Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to... | 2026-09-03 |
| CVE-2026-84326 | high | 8.8 | No | Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox... | 2026-09-03 |
| CVE-2026-84328 | low | 3.1 | No | Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proce... | 2026-09-03 |
| CVE-2026-84329 | medium | 5.3 | No | Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised th... | 2026-09-03 |
| CVE-2026-84331 | low | 3.1 | No | Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process... | 2026-09-03 |