Security advisories

high2026-06-25

CVE-2026-47110-Tiptap contains an input validation vulnerability resulting in DoS

ueberdosis/tiptap-php · GHSA-4595-7fjw-r3jh

high2026-06-24

CVE-2026-11998-Angular's deprecated package has a Cross-Site Scripting issue

angular/angular.js · GHSA-7x27-g8rg-x87w

medium2026-06-24

CVE-2026-53541-OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

olivetin/olivetin · GHSA-prj9-97mp-mwh2

low2026-06-24

CVE-2026-48709-OliveTin: ValidateArgumentType API Endpoint's Missing Authentication Allows Action and Argument Enumeration

olivetin/olivetin · GHSA-f637-w7p2-m7fx

high2026-06-24

CVE-2026-48708-OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination

olivetin/olivetin · GHSA-7fq5-7wr8-rjwj

critical2026-06-24

CVE-2026-45052-OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

openidentityplatform/openam · GHSA-p462-xxwx-pqf4

critical2026-06-24

CVE-2026-45051-OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

openidentityplatform/openam · GHSA-6c99-87fr-6q7r

medium2026-06-24

CVE-2026-57307-Jenkins Zowe zDevOps Plugin has a missing permission check

jenkinsci/zdevops-plugin · GHSA-xx59-jv36-5r44

high2026-06-24

CVE-2026-12986-Payara Server Full has a Cross-Site Request Forgery vulnerability

payara/payara · GHSA-x939-7fq5-v9v6

medium2026-06-24

CVE-2026-57300-Jenkins MCP Server Plugin missing a permission check

jenkinsci/mcp-server-plugin · GHSA-mpff-xhg4-vr45

medium2026-06-24

CVE-2026-57302-Jenkins FitNesse Plugin stores passwords unencrypted

jenkinsci/fitnesse-plugin · GHSA-j4ph-wp3c-c37w

medium2026-06-24

CVE-2026-57299-Jenkins Contrast Continuous Application Security Plugin missing permission checks

jenkinsci/contrast-continuous-application-security-plugin · GHSA-8263-qv4g-vfxr

medium2026-06-24

CVE-2026-57298-Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability

jenkinsci/contrast-continuous-application-security-plugin · GHSA-6qc4-57v3-28rr

high2026-06-24

CVE-2026-57301-Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE

adedayo/zapper · GHSA-5qh3-hxx9-w26p

medium2026-06-24

CVE-2026-57306-Jenkins Zowe zDevOps Plugin has a CSRF vulnerability

jenkinsci/zdevops-plugin · GHSA-43m2-hcmm-qpm7

medium2026-06-24

CVE-2026-57305-Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability

lucamilanesio/assembla-jenkins-plugin · GHSA-429r-3j78-2pxm

medium2026-06-24

CVE-2026-57304-Jenkins Assembla Plugin has a missing permission check

lucamilanesio/assembla-jenkins-plugin · GHSA-2r5w-jh6g-8hff

high2026-06-24

CVE-2026-57303-Jenkins Assembla Plugin has an XXE vulnerability

lucamilanesio/assembla-jenkins-plugin · GHSA-2q27-6p2h-q6r3

medium2026-06-24

CVE-2026-57282-Jenkins Git client Plugin has an OS command injection vulnerability on agents

jenkinsci/git-client-plugin · GHSA-wp5x-hrrw-6r4g

medium2026-06-24

CVE-2026-57291-Jenkins Gitee Plugin missing permission checks

jenkinsci/gitee-plugin · GHSA-wjmq-rpqq-w4h9