Open_Ultra_SAST/benchmarks/valid/train/verification_access_control.json

{
  "cases": [
    {
      "advisory_cited": true,
      "confidence": 0.1,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "apache-kafka-46a9a98dac1bc81e",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.2,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "apache-kafka-758e1fc455e8d3d4",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.2,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "apache-kafka-80ecbb6e2b4c894e",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "KRaftMigrationZkWriter.handleAclsDelta invoked during ZK-to-KRaft migration ACL reconciliation",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "apache-kafka-86d9d7a9718034e3",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "KRaftMigrationZkWriter.handleDelta (invoked during ZK-to-KRaft migration metadata sync; no in-repo HTTP route or CLI argument shown)",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "apache-kafka-a24b53ecb07d6b36",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.6,
      "entry_point": "validateS3AuthInfo (called during S3 token validation in OzoneDelegationTokenSecretManager)",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "apache-ozone-cdc7fa7f8ec13997",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.2,
      "entry_point": "/hazelcast/rest/maps/submit-job",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "apache-seatunnel-41f9a91b92ae6bec",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.75,
      "entry_point": "/hazelcast/rest/maps/submit-job (SubmitJobServlet) via JettyService.createJettyServer",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "apache-seatunnel-aff20b2911a11f57",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.35,
      "entry_point": "/hazelcast/rest/maps/submit-job",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "apache-seatunnel-c1d9182bb687ec27",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "HttpSyncDataService constructor invoked via Spring bean initialization using HttpConfig; no in-repo HTTP request handler or CLI argument source is shown",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "apache-shenyu-08bb00ae847d91de",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": false,
      "confidence": 0.05,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "apache-shenyu-21babb9f9e9ab4ab",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.3,
      "entry_point": "StatelessAuthFilter.onAccessDenied (Shiro AccessControlFilter)",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "apache-shenyu-2898cf36f15386c4",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.05,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "apache-shenyu-3392773569911d4d",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "HttpClientRegisterRepository.init(ShenyuRegisterCenterConfig) invoked via constructor during ShenYu client registration",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "apache-shenyu-48cd759b689a7006",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "RegisterUtils.doRegister (register client HTTP utility)",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "apache-shenyu-5aec8e2616aa9218",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "HttpSyncDataService.doFetchGroupConfig (HTTP sync client fetching configs from ShenYu Admin)",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "apache-shenyu-71dedd5f120287fd",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": false,
      "confidence": 0.05,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "apache-shenyu-86d1b994c1372ebd",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "HttpSyncDataService.doLongPolling (client-side long polling to ShenYu Admin /configs/listener)",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "apache-shenyu-8cbc4df3ac5b6e0b",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": false,
      "confidence": 0.1,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "apache-shenyu-9323af96ad3ae2fb",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": false,
      "confidence": 0.95,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "apache-shenyu-b4c7abef3b7d7a60",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "HttpClientRegisterRepository.persistInterface -> doRegister -> RegisterUtils.doRegister (HTTP POST to /shenyu-client/register-metadata)",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "apache-shenyu-bb0f638668edb9b3",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.35,
      "entry_point": "HttpLongPollingTask.run (client-side long polling thread in shenyu-sync-data-http)",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "apache-shenyu-d5ae868eba03eee3",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "HttpClientRegisterRepository.persistURI invoked by ShenYu client registration flow; no in-repo HTTP handler or CLI argument shown",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "apache-shenyu-ddf3e7dd3e6d25df",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "HttpClientRegisterRepository.init(ShenyuRegisterCenterConfig) invoked via ShenyuClientRegisterRepository SPI during client registration; no in-repo HTTP route or CLI argument shown",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "apache-shenyu-f40519f074a1b7cd",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "HttpClientRegisterRepository.persistURI / persistInterface (client-side registration to ShenYu Admin)",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "apache-shenyu-f885a44d7a6b41cf",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "defaultRequestInterceptor (axios request interceptor)",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "arthurfiorette-axios-cache-interceptor-b6059ee192dd17ef",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "extractHeaders (library utility; no in-repo route/handler/CLI argument shown)",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "arthurfiorette-axios-cache-interceptor-e8c5197ddfb12fb5",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.35,
      "entry_point": "AuthClientProvider constructor (src/server/auth-client-provider.ts)",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "auth0-nextjs-auth0-02b40a92c3a33337",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.35,
      "entry_point": "",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "aws-aws-dynamodb-encryption-java-07cd28b8ecd099ff",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": false,
      "confidence": 0.95,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "aws-aws-dynamodb-encryption-java-57437c3aec27942a",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.35,
      "entry_point": "",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "aws-aws-dynamodb-encryption-java-73d40fa78fd43933",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.35,
      "entry_point": "",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "aws-aws-dynamodb-encryption-java-b46a82506f9ed435",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": false,
      "confidence": 0.1,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "aws-aws-dynamodb-encryption-java-c96110ae95b592d2",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.35,
      "entry_point": "MostRecentProvider key reauthorization / LRUCache.clear()",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "aws-aws-dynamodb-encryption-java-dc048ae6130b9000",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.35,
      "entry_point": "",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "aws-aws-dynamodb-encryption-python-24b46b781636d2ae",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.95,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "aws-aws-dynamodb-encryption-python-61dcd0a9861e08a9",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.35,
      "entry_point": "",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "aws-aws-dynamodb-encryption-python-73fd155703fd3f7f",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "MostRecentProvider.encryption_materials (library API; no in-repo HTTP route or CLI handler shown)",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "aws-aws-dynamodb-encryption-python-9647ae75335f0a25",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "aws-aws-dynamodb-encryption-python-b3f52b37033a02d3",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.2,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "aws-aws-dynamodb-encryption-python-bf080d1693c13e38",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "examples/src/most_recent_provider_encrypted_table.py:encrypt_item",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "aws-aws-dynamodb-encryption-python-d713ce65ca1d1e54",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "sails.router.bind('/*', prepareSendHeaders(), 'all') when cors.allRoutes is true and cors.origin is '*'",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "balderdashy-sails-b89551ad8023e1de",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.6,
      "entry_point": "JMX/RMI interface bound via createJMXServer (JMXConnectorServerFactory.newJMXConnectorServer with JMXServiceURL(\"rmi\", null, rmiPort))",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "beobal-cassandra-695047212ddf8d34",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.1,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "dromara-sa-token-1784eba75b914622",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "SaRequestForServlet.getRequestPath() invoked during Sa-Token request routing/authentication for any incoming HTTP request",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "dromara-sa-token-4606223180a03c69",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "SaRequestForReactor.getRequestPath() invoked during Sa-Token route authentication in the reactor starter; no concrete in-repo handler or attacker-controlled source is shown in the provided context",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "dromara-sa-token-52d82e15725937c7",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.2,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "dromara-sa-token-761314754a33cca1",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "SaRequestForReactor.getRequestPath() invoked during Sa-Token route authentication filter (SaReactorFilter) processing of incoming ServerWebExchange requests",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "dromara-sa-token-7dfc28bc57def786",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.1,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "dromara-sa-token-7fdb18d581095fae",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.2,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "dromara-sa-token-a521eeadf1351e1f",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "SaRequestForServlet.getRequestPath() invoked during Sa-Token route matching for incoming servlet requests",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "dromara-sa-token-c5b90ba462ff9b12",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.75,
      "entry_point": "UserControls 'userControls' extension rendering the private-discussion button on a user's profile page; source is the target user's blocksPd/cannotBeDirectMessaged attributes",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "friendsofflarum-byobu-7173b8a509cf3e27",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.75,
      "entry_point": "PrivateDiscussionsUserPage.actionItems rendered via content() on the user private discussions page route (m.route.param('username'))",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "friendsofflarum-byobu-f34c4fa78b9178db",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.4,
      "entry_point": "parsePath(url)",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "ionicabizau-parse-path-48d212f285d46f4b",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "DefaultGraphConfigurationView#doSave form handler (configureDefaults URL) via StaplerRequest",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-analysis-core-plugin-e02e86e3c18ec1d6",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint /descriptorByName/com.microsoft.jenkins.keyvault.SecretStringCredentials/doVerifyConfiguration (doVerifyConfiguration in DescriptorImpl), invoked via web request with servicePrincipalId and secretIdentifier query parameters",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-azure-credentials-plugin-0dab78b4ed2c29bb",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler web endpoint doFillServicePrincipalIdItems on the Azure Credentials DescriptorImpl (form fill for servicePrincipalId), reachable by any user with Overall/Read permission",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-azure-credentials-plugin-144d42edd4fea476",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "jenkinsci-azure-credentials-plugin-36e89cc01c1af07f",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doVerifyConfiguration on AzureCredentials.DescriptorImpl, invoked via form validation request with query parameters (subscriptionId, clientId, clientSecret, etc.)",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-azure-credentials-plugin-81c51344b9d31af8",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler web method doFillCertificateIdItems on AzureCredentials.DescriptorImpl, invoked via the credentials configuration form (e.g. /descriptorByName/com.microsoft.azure.util.AzureCredentials/fillCertificateIdItems) with the certificateId query parameter",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-azure-credentials-plugin-a83f939fb055e6a0",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint DescriptorImpl.doVerifyConfiguration (form validation endpoint) invoked via web request with @QueryParameter servicePrincipalId/secretIdentifier/password",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-azure-credentials-plugin-af7645f7ae48e24c",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.75,
      "entry_point": "DescriptorImpl.doVerifyConfiguration (@POST, @QueryParameter subscriptionId/clientId/azureEnvironmentName)",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-azure-credentials-plugin-bd1228731e6d22aa",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins DescriptorImpl.doVerifyConfiguration (AzureImdsCredentials) exposed via Stapler HTTP endpoint /descriptorByName/.../doVerifyConfiguration with @QueryParameter subscriptionId, clientId, azureEnvironmentName",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-azure-credentials-plugin-d3c1129ce0199756",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "jenkinsci-azure-keyvault-plugin-344db7c550754ab3",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillCredentialIDOverrideItems on AzureKeyVaultBuildWrapper.DescriptorImpl (form fill for credentialIDOverride field), reachable by any user with Overall/Read permission",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-azure-keyvault-plugin-a9975f6d8b4f1568",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.75,
      "entry_point": "DescriptorImpl.doFillCredentialIDItems (Jenkins Stapler HTTP endpoint /job/.../descriptorByName/.../fillCredentialIDItems)",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-azure-keyvault-plugin-abd182ce20617255",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "GithubServerContainer.create(@JsonBody JSONObject request) invoked via Blue Ocean HTTP endpoint for creating GitHub server; attacker-controlled source is the 'apiUrl' field in the JSON request body, which is passed to HttpRequest.get(url).connect()",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-blueocean-plugin-5aa4f2eb0a53ebfe",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.75,
      "entry_point": "Blue Ocean REST endpoint POST /blueocean/rest/.../servers (ScmServerEndpointContainer.create) accepting JSONObject request with attacker-controlled API_URL",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-blueocean-plugin-e4ad2dadd845ec00",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job/<name>/descriptorByName/.../fillConnectionIdItems) invoked via config.jelly connectionId field; attacker-controlled source is the HTTP request with Overall/Read permission",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-compuware-scm-downloader-plugin-29636a1534a39217",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job/<name>/descriptorByName/.../fillConnectionIdItems) invoked via config.jelly connectionId field; attacker-controlled source is the HTTP request with Overall/Read permission",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-compuware-scm-downloader-plugin-316557e9fdf67223",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillCredentialsIdItems (e.g. /job/<name>/descriptorByName/.../fillCredentialsIdItems) invoked with Overall/Read permission; attacker-controlled source is the credentialsId query parameter and the project ancestor context",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-compuware-scm-downloader-plugin-4b64810cb01a07f5",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job/<name>/descriptorByName/.../fillConnectionIdItems) invoked via config.jelly connectionId field; attacker-controlled source is the HTTP request with Overall/Read permission",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-compuware-scm-downloader-plugin-936a096a4a941ee5",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job/<name>/descriptorByName/.../fillConnectionIdItems) invoked via @QueryParameter connectionId",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-compuware-scm-downloader-plugin-c416a32628e63296",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillCredentialsIdItems (descriptor form fill for credentialsId), reachable via Overall/Read authenticated user; source is the credentialsId query parameter and the credentials store enumerated via CredentialsProvider.lookupCredentials",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-compuware-topaz-for-total-test-plugin-0fcc9e440100be20",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job/<name>/descriptorByName/.../fillConnectionIdItems) invoked with Overall/Read permission; @QueryParameter connectionId is attacker-controlled",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-compuware-topaz-for-total-test-plugin-31007615cf224711",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job/<name>/descriptorByName/.../fillConnectionIdItems) invoked via @QueryParameter connectionId",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-compuware-topaz-for-total-test-plugin-3b2dc3167c986714",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillCredentialsIdItems on TotalTestCTBuilder (e.g. /job/<name>/descriptorByName/.../fillCredentialsIdItems), invoked via @QueryParameter credentialsId with Overall/Read permission",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-compuware-topaz-for-total-test-plugin-8659f27b971d364f",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillServerUrlItems / doFillServerCredentialsIdItems (form fill methods invoked via Jenkins UI/HTTP request with Overall/Read permission)",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-compuware-topaz-for-total-test-plugin-b0ca3df515237e75",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillServerCredentialsIdItems (descriptor form fill method) reachable via the build step configuration UI; attacker-controlled source is the @QueryParameter serverCredentialsId and the Overall/Read authenticated user",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-compuware-topaz-for-total-test-plugin-e724ca5f96b58ee5",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.75,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillCredentialIDItems (form fill for credential ID field), invoked via web request with uri query parameter",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-conjur-credentials-plugin-11205c0022207637",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillCredentialIDItems on ConjurSecretUsernameSSHKeyCredentialsImpl.DescriptorImpl, invoked via the credentials form fill (e.g. credentialID field) with @QueryParameter uri",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-conjur-credentials-plugin-25bfc860016819fb",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillCredentialIDItems on ConjurSecretUsernameCredentialsImpl.DescriptorImpl, invoked via the credentials form fill (e.g. /descriptorByName/.../fillCredentialIDItems) with attacker-controlled @QueryParameter uri",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-conjur-credentials-plugin-f42fa606284883ea",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.35,
      "entry_point": "doFillCredentialsIdItems (Jenkins CRX Content Package Deployer Plugin)",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "jenkinsci-crx-content-package-deployer-plugin-596545c415c69324",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint /descriptor/.../fillCredentialsIdItems (doFillCredentialsIdItems) invoked via form binding with @QueryParameter value",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-crx-content-package-deployer-plugin-79286d969348bd3c",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Stapler form validation endpoint doValidate on AbstractRemoteDatabaseDescriptor (e.g. /descriptorByName/.../validate) invoked via HTTP with @QueryParameter hostname, database, username, password, properties",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-database-plugin-6a8e141d0c9eaab2",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins form validation endpoint /descriptorByName/org.jenkinsci.plugins.database.GenericDatabase/doValidate (and doCheckDriver), invoked via HTTP with attacker-controlled driver, url, username, password query parameters",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-database-plugin-d2e038dce743f4f4",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins form validation endpoint doValidate (Descriptor.doValidate) invoked via HTTP POST with query parameters driver, url, username, password",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-database-plugin-fdb5a7fd01260ec1",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.6,
      "entry_point": "Stapler HTTP endpoint doCheckDirectoryPath (FormValidation) on FixedDirectoryDeploySource.DescriptorImpl, invoked via @QueryParameter fromWorkspace/targetDescriptorId/value",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-deployer-framework-plugin-2929f3e176f304ad",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.35,
      "entry_point": "doCheckFilePattern (Stapler form validation endpoint) via @QueryParameter value/fromWorkspace",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "jenkinsci-deployer-framework-plugin-3dcef248457afa3c",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": false,
      "confidence": 0.9,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "jenkinsci-deployer-framework-plugin-4054ff468fb73960",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": false,
      "confidence": 0.1,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "jenkinsci-deployer-framework-plugin-ae8faa0c6fd87339",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": false,
      "confidence": 0.2,
      "entry_point": "doCheckFilePath",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "jenkinsci-deployer-framework-plugin-cd642d5bde48aa37",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Stapler HTTP endpoint doDeployText (DeployNowRunAction) reachable via URL /job/<job>/<build>/deploy-text or similar Stapler route; attacker-controlled source is the HTTP request handled by StaplerRequest req, with only Item/Read permission required pre-fix",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-deployer-framework-plugin-dd5ef66a767e04d5",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler form validation endpoint doTestConnection on EC2Cloud.DescriptorImpl, invoked via HTTP form validation request with attacker-controlled ec2endpoint, credentialsId, roleArn, roleSessionName, region parameters",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-ec2-plugin-6058527110940076",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler form validation endpoint /descriptorByName/hudson.plugins.ec2.EC2Cloud/doGenerateKey (and doTestConnection), invoked via HTTP with attacker-controlled ec2EndpointUrl, credentialsId, region parameters",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-ec2-plugin-92278d8bf0b7f60a",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.9,
      "entry_point": "HTTP POST to the ElectricFlowEFRunAPIAction endpoint (getUrlName() URL_NAME) invoking doBuild(StaplerRequest, StaplerResponse); attacker-controlled JSON body read via req.getReader() supplies flowRuntimeId/projectName/releaseName/buildParams and triggers Jenkins.get().getQueue().schedule(project, ...)",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-electricflow-plugin-b319df3a71ebd890",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.95,
      "entry_point": "/git/notifyCommit webhook endpoint handled by GitStatus.doNotifyCommit(HttpServletRequest, url, branches, sha1)",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-git-plugin-751c41fb6795520f",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.2,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "jenkinsci-global-build-stats-plugin-1a19ed9dc1628163",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.9,
      "entry_point": "GlobalBuildStatsApi.doPython (and doJson/doXml) REST API endpoint via Stapler, source: buildStatConfigId request parameter",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-global-build-stats-plugin-b2560994597ff44f",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "GlobalBuildStatsApi.doJson (REST API endpoint /api/json via getApi()), source: buildStatConfigId request parameter",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-global-build-stats-plugin-ee8d1b0fdf63b4ee",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins HTTP endpoint invoking DescriptorImpl.doCheckScript with @QueryParameter String command (Groovy command script source descriptor)",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-groovy-plugin-74141466f39e1a12",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.9,
      "entry_point": "Jenkins Stapler HTTP endpoint DescriptorImpl.doTestConnection (Vault Username-Password Credential descriptor), invoked via form validation request with attacker-controlled query parameters path, usernameKey, passwordKey, prefixPath, namespace, engineVersion",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-hashicorp-vault-plugin-4b8dac7099e598b2",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.9,
      "entry_point": "Jenkins Stapler HTTP endpoint doTestConnection on VaultSSHUserPrivateKeyImpl.DescriptorImpl (e.g. /descriptorByName/.../testConnection), with attacker-controlled query parameters path, usernameKey, privateKeyKey, passphraseKey, prefixPath, namespace, engineVersion",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-hashicorp-vault-plugin-69b136827df9a5c0",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doTestConnection on VaultStringCredentialImpl.DescriptorImpl, invoked via the credential configuration form with attacker-controlled query parameters path, vaultKey, prefixPath, namespace, engineVersion",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-hashicorp-vault-plugin-7782cfb6ae3f0339",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint DescriptorImpl.doTestConnection (e.g. /descriptorByName/.../testConnection) with @QueryParameter path/keyStoreKey/passwordKey/prefixPath/namespace/engineVersion",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-hashicorp-vault-plugin-9f7965aeec3cc869",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doTestConnection on VaultFileCredentialImpl.DescriptorImpl (e.g. /descriptorByName/com.datapipe.jenkins.vault.credentials.common.VaultFileCredentialImpl/testConnection), with attacker-controlled query parameters path, useKey, vaultKey, prefixPath, namespace, engineVersion",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-hashicorp-vault-plugin-c76a541ee22b2ef9",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint DescriptorImpl.doTestConnection (e.g. /descriptorByName/.../testConnection) with @QueryParameter path/prefixPath/namespace/engineVersion",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-hashicorp-vault-plugin-e7d568b004427b1d",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.9,
      "entry_point": "Jenkins Stapler HTTP endpoint doValidateGlobal on JiraTestDataPublisher (global.jelly 'Validate Settings' button), parameters jiraUrl/username/password",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-jiratestresultreporter-plugin-28213733c6b799eb",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins form validation endpoint doValidateClient (GlobalPluginConfiguration), invoked via Jenkins form validation HTTP request with attacker-controlled 'server' and 'namespace' query parameters",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-jx-resources-plugin-e1eb49dbe32bfc7a",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.6,
      "entry_point": "getCredentials(Class, ItemGroup, Authentication) invoked by Jenkins credential lookup for Item/Configure context",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "jenkinsci-kubernetes-credentials-provider-plugin-57a88280765b1e09",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillApplicationIdItems (e.g. /job/<name>/descriptorByName/com.mabl.integration.jenkins.MablStepBuilder/fillApplicationIdItems) with attacker-controlled query parameters restApiKeyId, apiBaseUrl, appBaseUrl",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-mabl-integration-plugin-010c7741299085f7",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillRestApiKeyIdItems (e.g. /job/<name>/descriptorByName/com.mabl.integration.jenkins.MablStepBuilder/fillRestApiKeyIdItems) invoked with attacker-controlled restApiKeyId query parameter",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-mabl-integration-plugin-33601449707f721c",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.4,
      "entry_point": "MablStepBuilderValidator.validateForm (called from Jenkins form validation endpoints)",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "jenkinsci-mabl-integration-plugin-3a199b7d022bdfe5",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "MablStepBuilder.perform (Jenkins build step)",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "jenkinsci-mabl-integration-plugin-3d90ae999d4689d3",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "doFillApplicationIdItems HTTP endpoint (Jenkins Stapler @QueryParameter restApiKeyId, disableSslVerification, apiBaseUrl, appBaseUrl) reachable by users with Overall/Read permission",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-mabl-integration-plugin-5f366608a3d422b4",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doCheckRestApiKeyIds (and doFillApplicationIdItems) on MablStepBuilder, invoked via the mabl build step configuration form; attacker-controlled source is the @QueryParameter value/restApiKeyId supplied in the HTTP request by a user with Overall/Read permission",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-mabl-integration-plugin-60b82fbf81b044f5",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillEnvironmentIdItems (MablStepBuilder), reachable via GET/POST to the descriptor fill URL with attacker-controlled query parameters restApiKeyId, disableSslVerification, apiBaseUrl, appBaseUrl",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-mabl-integration-plugin-8cc76fc9d5aa0984",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.4,
      "entry_point": "",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "jenkinsci-mabl-integration-plugin-9ddc5ff387bbb591",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "MablStepDescriptor.doValidateForm HTTP endpoint (Stapler @QueryParameter restApiKeyId/environmentId/applicationId/disableSslVerification/apiBaseUrl/appBaseUrl)",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-mabl-integration-plugin-b2206be4bf8e37fb",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "doFillEnvironmentIdItems (Jenkins Stapler HTTP endpoint, @QueryParameter restApiKeyId/apiBaseUrl/appBaseUrl/disableSslVerification)",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-mabl-integration-plugin-c9df9fe333e3ed08",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": false,
      "confidence": 0.1,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "jenkinsci-nomad-plugin-1a444f0c3a3de4ab",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": false,
      "confidence": 0.05,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "jenkinsci-nomad-plugin-403729afe7779e2f",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": false,
      "confidence": 0.9,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "jenkinsci-nomad-plugin-56abb322562d7fea",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.75,
      "entry_point": "NomadCloud.DescriptorImpl#doCheckName form validation endpoint (Jenkins Stapler HTTP route /descriptorByName/org.jenkinsci.plugins.nomad.NomadCloud/checkName), source: @QueryParameter String name",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-nomad-plugin-81a6fad8feb01b11",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.05,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "jenkinsci-nomad-plugin-a7a1804a33cf4326",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.05,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "jenkinsci-nomad-plugin-c6b7d6e58fa1693b",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "NomadCloud.DescriptorImpl#doTestConnection (Jenkins form validation endpoint, @QueryParameter nomadUrl)",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "jenkinsci-nomad-plugin-c7e4a3d0c1c4849f",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.2,
      "entry_point": "NomadCloud.DescriptorImpl#doTestConnection",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "jenkinsci-nomad-plugin-d3f7cd1e7c5bc993",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": false,
      "confidence": 0.05,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "jenkinsci-nomad-plugin-d856616760544412",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.1,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "jenkinsci-nomad-plugin-d85bd7c2c374007c",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "IdTokenCredentials.token() invoked during build ID token generation; attacker-controlled source is job-configured environment variables via build.getEnvironment(TaskListener.NULL)",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "jenkinsci-oidc-provider-plugin-7818508f27f9b0cf",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doCheckElasticsearchCredentialsId (form validation for ElasticLogsBackendWithJenkinsVisualization), invoked via POST with elasticsearchCredentialsId query parameter by a user with Overall/Read permission",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-opentelemetry-plugin-62ce6dc3488e0d80",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.75,
      "entry_point": "Jenkins Stapler HTTP endpoint doFillElasticsearchCredentialsIdItems on the ElasticLogsBackendWithJenkinsVisualization.DescriptorImpl (invoked via the plugin configuration form, e.g. /descriptorByName/.../fillElasticsearchCredentialsIdItems), with attacker-controlled source being the elasticsearchCredentialsId query parameter",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-opentelemetry-plugin-c258c6ed37f2c061",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint DescriptorImpl.doValidate (and doCheckElasticsearchUrl/doCheckElasticsearchCredentialsId) invoked via form validation request with attacker-controlled elasticsearchUrl and elasticsearchCredentialsId query parameters",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-opentelemetry-plugin-e7dc96d707803ae7",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins Stapler HTTP endpoint doValidate on ElasticLogsBackendWithJenkinsVisualization (POST form validation), attacker-controlled elasticsearchUrl and elasticsearchCredentialsId query parameters",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-opentelemetry-plugin-f0ff00bf7375eb29",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.9,
      "entry_point": "Jenkins Stapler form validation endpoint doTestConnection (e.g. /descriptorByName/jenkins.plugins.rocketchatnotifier.RocketChatNotifier/doTestConnection) with attacker-controlled query parameters rocketServerUrl, username, password, webhookToken, webhookTokenCredentialId",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-rocketchatnotifier-plugin-16d28ce862d5a528",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "Jenkins CLI command 'support' (SupportCommand.run) invoked via CLI channel; attacker-controlled source is the CLI invocation by a user holding Support/DownloadBundle permission",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-support-core-plugin-3de9ccb2591c7490",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "SupportAction (RootAction, urlName \"support\") via StaplerProxy getTarget(); HTTP request to /support/... reaches getTarget() which checks CREATE_BUNDLE (Support/DownloadBundle) instead of Jenkins.ADMINISTER, allowing users with only Support/DownloadBundle permission to access support bundle endpoints",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "jenkinsci-support-core-plugin-934a17bf668da541",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.55,
      "entry_point": "KubeSpawner._expand_user_properties via pod_name_template/pvc_name_template expansion during spawner start",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "jupyterhub-kubespawner-57df9101381186fd",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.35,
      "entry_point": "UnsafeAccess.getInstance()",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "karlamoe-unsafe-accessor-cb53a2ad43e1b227",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.75,
      "entry_point": "GET /save-invoice/{customer}/{template} (route name invoice_create) in InvoiceController::createInvoiceAction",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "kimai-kimai-166480170479d403",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "GET /preview/{customer}/{template} route (invoice_preview) in InvoiceController::previewAction; attacker-controlled source is the {customer} route parameter (Customer entity) and {template} parameter, with only is_granted('view_invoice') enforced pre-fix",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "kimai-kimai-5e04ee92bdb735ea",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.2,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "kimai-kimai-815fd0d991d70291",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.4,
      "entry_point": "getQueryBuilderForFormType (CustomerRepository) invoked via CustomerType form query_builder option",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "kimai-kimai-a8c6bbf29f9b36d3",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.2,
      "entry_point": "",
      "fix_addresses_it": false,
      "human_spot_check": null,
      "id": "kimai-kimai-f2cf381ed1aae3b0",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": false
    },
    {
      "advisory_cited": true,
      "confidence": 0.4,
      "entry_point": "voteOnAttribute",
      "fix_addresses_it": true,
      "human_spot_check": null,
      "id": "kimai-kimai-f819426bece7562e",
      "model": "deepseek-flash",
      "reachable_in_repo": false,
      "verdict": "rejected",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.85,
      "entry_point": "WebSocket TerminalWebsocketServer.open (terminal_server.py) via /terminals/websocket route; attacker-controlled source: websocket query arguments api_key, token, cwd, term_name",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "mage-ai-mage-ai-c9810ee637c308c0",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    },
    {
      "advisory_cited": true,
      "confidence": 0.6,
      "entry_point": "Terminal component (mage_ai/frontend/components/Terminal/index.tsx) rendered in the Mage web UI; keyboard input via registerOnKeyDown and sendMessage WebSocket channel",
      "fix_addresses_it": true,
      "human_spot_check": {
        "date": "2026-10-13",
        "decision": "accept",
        "reviewer": "mc"
      },
      "id": "mage-ai-mage-ai-d1ee6d54adc38f57",
      "model": "deepseek-flash",
      "reachable_in_repo": true,
      "verdict": "accepted",
      "vulnerable_pre_fix": true
    }
  ]
}