Filtered by vendor Jenkins Project
Subscriptions
Total
128 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19429 | 1 Jenkins Project | 1 Jenkins | 2026-08-13 | 6.5 Medium |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-70426 | 1 Jenkins Project | 2 Jenkins, Remoting | 2026-08-07 | 9 Critical |
| In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath. | ||||
| CVE-2026-70433 | 1 Jenkins Project | 1 Jenkins Hcl Appscan Plugin | 2026-08-07 | 4.3 Medium |
| Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2026-70434 | 1 Jenkins Project | 1 Jenkins Scm-manager Plugin | 2026-08-07 | 4.2 Medium |
| A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | ||||
| CVE-2026-70435 | 1 Jenkins Project | 1 Jenkins Scm-manager Plugin | 2026-08-07 | 4.2 Medium |
| A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | ||||
| CVE-2026-70437 | 1 Jenkins Project | 1 Jenkins Webhook Secret Credentials Provider Plugin | 2026-08-07 | 3.7 Low |
| Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bearer token. | ||||
| CVE-2026-70438 | 1 Jenkins Project | 1 Jenkins Parameterized Remote Trigger Plugin | 2026-08-07 | 4.3 Medium |
| A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2026-70439 | 1 Jenkins Project | 1 Jenkins Xml Job To Job Dsl Plugin | 2026-08-07 | 6.5 Medium |
| Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality. | ||||
| CVE-2026-70440 | 1 Jenkins Project | 1 Jenkins Qualys Container Scanning Connector Plugin | 2026-08-07 | 5.4 Medium |
| Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | ||||
| CVE-2026-70441 | 1 Jenkins Project | 1 Jenkins Summary Display Plugin | 2026-08-07 | 5.4 Medium |
| Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Create or Item/Configure permission. | ||||
| CVE-2026-70442 | 1 Jenkins Project | 1 Jenkins Google Chat Notification Plugin | 2026-08-07 | 4.3 Medium |
| Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to use. | ||||
| CVE-2026-70443 | 1 Jenkins Project | 1 Jenkins Horreum Plugin | 2026-08-07 | 4.3 Medium |
| Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL. | ||||
| CVE-2026-70444 | 1 Jenkins Project | 1 Jenkins Violation Comments To Gitlab Plugin | 2026-08-07 | 4.3 Medium |
| A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2026-70445 | 1 Jenkins Project | 1 Jenkins Sauce Ondemand Plugin | 2026-08-07 | 4.3 Medium |
| Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2026-70446 | 1 Jenkins Project | 1 Jenkins Codesonar Plugin | 2026-08-07 | 4.3 Medium |
| Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2026-70447 | 1 Jenkins Project | 1 Jenkins Aws Codebuild Plugin | 2026-08-07 | 4.3 Medium |
| Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2026-70448 | 1 Jenkins Project | 1 Jenkins Ivy Report Plugin | 2026-08-07 | 7.1 High |
| Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing Ivy report files. | ||||
| CVE-2026-70436 | 1 Jenkins Project | 1 Jenkins External Workspace Manager Plugin | 2026-08-06 | 4.3 Medium |
| Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper permission check (1.4.1) when providing access to externally-managed workspaces through the workspace browser, allowing attackers with Overall/Read permission to read files in workspaces they are not authorized to access. | ||||
| CVE-2026-70431 | 1 Jenkins Project | 1 Jenkins Multijob Plugin | 2026-08-05 | 8.8 High |
| Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM. | ||||
| CVE-2026-70432 | 1 Jenkins Project | 1 Jenkins Multijob Plugin | 2026-08-05 | 8.8 High |
| A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM. | ||||