https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T19:45:33.460373+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-jenkins-2020-2101 BIT-jenkins-2020-2101 2026-10-07T19:45:33.469335+00:00

Affected: Bitnami: jenkins

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.

 https://cve.radiocsirt.org/vuln/euvd-2026-35786 EUVD-2026-35786 2026-10-07T19:45:33.469436+00:00 EUVD-2026-35786 https://cve.radiocsirt.org/vuln/fkie_cve-2020-2101 fkie_cve-2020-2101 2026-10-07T19:45:33.469453+00:00

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.

 https://cve.radiocsirt.org/vuln/ghsa-w7jr-wqw6-54xc GHSA-w7jr-wqw6-54xc — Non-constant time comparison of inbound TCP agent connection secret 2026-10-07T19:45:33.469476+00:00

Affected: Maven: org.jenkins-ci.main:jenkins-core

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not use a constant-time comparison validating the connection secret when an inbound TCP agent connection is initiated. This could potentially allow attackers to use statistical methods to obtain the connection secret.

Jenkins 2.219, LTS 2.204.2 now uses a constant-time comparison function for verifying connection secrets.

 https://cve.radiocsirt.org/vuln/gsd-2020-2101 gsd-2020-2101 2026-10-07T19:45:33.469500+00:00 gsd-2020-2101 https://cve.radiocsirt.org/vuln/rhba-2020:0402 RHBA-2020:0402 — Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update 2026-10-07T19:45:33.469512+00:00

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection jenkins: Inbound TCP Agent Protocol/3 authentication bypass jenkins: UDP multicast/broadcast service amplification reflection attack jenkins: Non-constant time comparison of inbound TCP agent connection secret jenkins: Non-constant time HMAC comparison jenkins: Exposed session identifiers on user detail object in the whoAmI diagnostic page jenkins: Memory usage graphs accessible to anyone with Overall/Read jenkins: REST APIs vulnerable to clickjacking