CVE-2026-9674

MediumCVSS 4.3/10Last modified Oct 14, 2026

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failed Multijob builds.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: May 27, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-967406.5A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are co CVE-2026-967436.4The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versio CVE-2026-967447.1Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can CVE-2026-967455.6Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document con CVE-2026-967466.5An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resol CVE-2026-967475.0The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a CVE-2026-967486.5PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimite CVE-2026-967498.4An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single CVE-2026-96757.5Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed me CVE-2026-967507.1MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the CVE-2026-967517.3A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the func CVE-2026-967527.2The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7