GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
6965
Downloads
12.9M
Verified
6965
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
1 rules matched. Showing 1 loaded rules.
Publish rule
CVE-2026-84667: Jenkins Global Configuration Databound Constructorcve-2026-84667-jenkins-global-configuration-databound-constructor

Classes extending GlobalConfiguration must not use @DataBoundConstructor on their constructors. Global configurations are singletons managed by Jenkins, and exposing a @DataBoundConstructor enables Stapler data binding to instantiate or modify the configuration without proper authorization.

JavaCVE-2026-84667CWE-284CWE-915
by Provallyupdated 2026-10-27Apache-2.0
460 direct46 via packs
72
All matching rules loaded.