CVE-2026-84667

ThinBackup Plugin Backup Configuration Overwrite Vulnerability

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jenkins Project

Products

Jenkins Thinbackup Plugin

CVE-2026-84668

Jenkins SAML Plugin Metadata File Overwrite Allows User Impersonation

Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jenkins Project

Products

Jenkins Saml Plugin

CVE-2026-84669

Allure Plugin Path Traversal Allows Reading Arbitrary Files

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jenkins Project

Products

Jenkins Allure Plugin

CVE-2026-84670

Jenkins Performance Plugin Deserialization Allows Remote Code Execution

Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jenkins Project

Products

Jenkins Performance Plugin

CVE-2026-84671

Jenkins File Parameter Plugin allows arbitrary file writes leading to remote code execution

Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jenkins Project

Products

Jenkins File Parameter Plugin

CVE-2026-84673

Stored XSS via Plugin Configuration Injection in Jenkins Customizable Header Plugin

Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jenkins Project

Products

Jenkins Customizable Header Plugin

CVE-2026-84674

Missing Permission Checks Allow Credential ID Enumeration in Jenkins XebiaLabs XL Deploy Plugin

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Project

Products

Jenkins Xebialabs Xl Deploy Plugin

CVE-2026-85182

vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Lenve

Products

Vhr

CVE-2026-85100

2FastLabs agent-squad Streaming Agent Response Workflow orchestrator.ts AgentSquad.routeRequest resource consumption

A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squad/typescript/src/orchestrator.ts of the component Streaming Agent Response Workflow. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

2fastlabs

Products

Agent-squad

CVE-2026-85021

langgenius dify Splash Layout splash.tsx router.replace cross site scripting

A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirect_url causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Langgenius

Products

Dify

CVE-2026-84857

sigoden aichat API Endpoint serve.rs memory allocation

A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulation causes uncontrolled memory allocation. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sigoden

Products

Aichat

CVE-2026-84839

tsi-coop tsi-dpdp-cms Admin Console/DPO Compliance Console web.xml missing authentication

A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.5.1 can resolve this issue. It is suggested to upgrade the affected component.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Tsi-coop

Products

Tsi-dpdp-cms

CVE-2026-84437

OpenCart Autocomplete Workflow address.php cross site scripting

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address_1 results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Opencart

Products

Opencart

CVE-2026-84423

Casdoor upload-resource API resource.go missing authentication

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Casdoor

Products

Casdoor

CVE-2026-84367

joi: object().rename() with a template target can set the validated object's prototype

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hapijs

Products

Joi

CVE-2026-83615

xmldom: Quadratic-memory consumption

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses _copy to clone the complete currentNSMap for each nested element that declares a new namespace prefix. Keeping every ancestor map live on the parse stack creates quadratic peak namespace-map storage, so a small highly compressible XML document can exhaust the process heap before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Xmldom

Products

Xmldom

CVE-2026-77790

RegistrationMagic < 6.0.9.4 - Admin+ SQLi via 'rm_sortby' Parameter

The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Registrationmagic Wordpress

Products

Registrationmagic Wordpress

CVE-2026-19722

WPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup Restore

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can lead to code execution.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpvividplugins

Products

Wordpress Wpvivid — Backup, Migration & Staging

CVE-2026-12555

HP Easy Start for macOS - Security Update

Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Hp Inc

Products

Hp Easy Start For Macos

CVE-2026-12554

HP Easy Start for macOS - Security Update

Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Hp Inc

Products

Hp Easy Start For Macos