Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-117620 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data... | 2026-10-29 |
| CVE-2026-117619 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API toke... | 2026-10-29 |
| CVE-2026-117618 | not reported | — | No | In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setu... | 2026-10-29 |
| CVE-2026-117617 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its paren... | 2026-10-29 |
| CVE-2026-117616 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing... | 2026-10-29 |
| CVE-2026-117615 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing atta... | 2026-10-29 |
| CVE-2026-117614 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the... | 2026-10-29 |
| CVE-2026-117613 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers wit... | 2026-10-29 |
| CVE-2026-117612 | not reported | — | No | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attr... | 2026-10-29 |
| CVE-2026-115644 | not reported | — | No | Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a... | 2026-10-29 |
| CVE-2026-112375 | not reported | — | No | An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a broker read a file or an environment varia... | 2026-10-29 |
| CVE-2026-111551 | not reported | — | No | Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte... | 2026-10-29 |
| CVE-2026-111496 | not reported | — | No | Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timesta... | 2026-10-29 |
| CVE-2026-111115 | not reported | — | No | Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTagged... | 2026-10-29 |
| CVE-2026-111108 | not reported | — | No | Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is c... | 2026-10-29 |
| CVE-2026-110985 | not reported | — | No | A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its impl... | 2026-10-29 |
| CVE-2026-110952 | not reported | — | No | A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, b... | 2026-10-29 |
| CVE-2026-93522 | high | 7.8 | No | A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1... | 2026-10-29 |
| CVE-2026-93521 | high | 7.8 | No | A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by auth... | 2026-10-29 |
| CVE-2026-116370 | critical | 9.6 | No | A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of th... | 2026-10-29 |