Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Jun 24, 2026A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an atCVE-2026-57307 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.2
A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- Product
- Jenkins Zowe zDevOps Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attackerCVE-2026-57306 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.2
A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- Product
- Jenkins Zowe zDevOps Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024The conformance validation endpoint is public so everybody can verify the conformance of onboarded services.CVE-2024-9802 · Other software · Open Mainframe Project · reported by zowe-security@lists.openmainframeproject.orgMedium 5.3
The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The attacker could also check if a service is running.
- Product
- Zowe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024The health endpoint is public so everybody can see a list of all services.CVE-2024-9798 · Other software · Open Mainframe Project · reported by zowe-security@lists.openmainframeproject.orgCritical 9
The health endpoint is public so everybody can see a list of all services. It is potentially valuable information for attackers.
- Product
- Zowe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2024A vulnerability in Zowe CLI allows local, privileged actors to display securely stored properties in cleartext within a terminal using the '--show-inputs-only' CVE-2024-6916 · Other software · Open Mainframe Project · reported by zowe-security@lists.openmainframeproject.orgMedium 5.9
A vulnerability in Zowe CLI allows local, privileged actors to display securely stored properties in cleartext within a terminal using the '--show-inputs-only' flag.
- Product
- Zowe CLI - Imperative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2024A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate.CVE-2024-6834 · Other software · Open Mainframe Project · reported by zowe-security@lists.openmainframeproject.orgCritical 9
A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows access to a user to the endpoints requiring an internal client certificate without any credentials. It could lead to managing components in there and allow an attacker to handle the whole communication including user credentials.
- Product
- Zowe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2024A vulnerability in Zowe CLI allows local, privileged actors to store previously entered secure credentials in a plaintext file as part of an auto-init operationCVE-2024-6833 · Other software · Open Mainframe Project · reported by zowe-security@lists.openmainframeproject.orgMedium 5.9
A vulnerability in Zowe CLI allows local, privileged actors to store previously entered secure credentials in a plaintext file as part of an auto-init operation.
- Product
- Zowe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or CVE-2021-4326 · Other software · Open Mainframe Project · reported by zowe-security@lists.openmainframeproject.orgLow 3.3
A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables. Impacts Zowe CLI.
- Product
- Zowe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2023It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user.CVE-2021-4314 · Other software · Open Mainframe Project · reported by zowe-security@lists.openmainframeproject.orgMedium 5.3
It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue affects: 1.16 versions to 1.19. What happens is that the services using the ZAAS client or the API ML API to query will be deceived into believing the information in the JWT token is valid when it isn’t. It’s possible to use this to persuade the southbound service that different user is authenticated.
- Product
- Zowe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.