Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84357 | medium | 6.5 | No | Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypa... | 2026-09-03 |
| CVE-2026-84358 | medium | 4.2 | No | Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the rendere... | 2026-09-03 |
| CVE-2026-84347 | high | 8.8 | No | Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via... | 2026-09-03 |
| CVE-2026-84348 | medium | 6.5 | No | Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak sensitive information... | 2026-09-03 |
| CVE-2026-51788 | high | 7.5 | No | An issue in cleverange_auth v.0.1.10 allows a remote attacker to cause a denial of service via the account_verification function and the acc... | 2026-09-03 |
| CVE-2026-84349 | high | 8.3 | No | Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to exec... | 2026-09-03 |
| CVE-2026-84359 | low | 3.1 | No | Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak... | 2026-09-03 |
| CVE-2026-84677 | medium | 5.4 | No | Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugi... | 2026-09-03 |
| CVE-2026-84676 | medium | 4.3 | No | Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller wh... | 2026-09-03 |
| CVE-2026-84675 | high | 7.4 | No | OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable v... | 2026-09-03 |
| CVE-2026-84674 | medium | 5.4 | No | Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate... | 2026-09-03 |
| CVE-2026-84673 | high | 8.8 | No | Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler... | 2026-09-03 |
| CVE-2026-84672 | high | 8.8 | No | Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's... | 2026-09-03 |
| CVE-2026-84671 | high | 8.8 | No | Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file sys... | 2026-09-03 |
| CVE-2026-84670 | high | 8.8 | No | Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached... | 2026-09-03 |
| CVE-2026-84669 | high | 8.8 | No | A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish A... | 2026-09-03 |
| CVE-2026-84668 | high | 8.8 | No | Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data bindi... | 2026-09-03 |
| CVE-2026-84667 | high | 7.1 | No | Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing atta... | 2026-09-03 |
| CVE-2026-84665 | high | 8.0 | No | Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner... | 2026-09-03 |
| CVE-2026-84664 | medium | 5.4 | No | Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowin... | 2026-09-03 |