https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T23:11:57.203668+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-jenkins-2020-2102 BIT-jenkins-2020-2102 2026-10-07T23:11:57.209556+00:00

Affected: Bitnami: jenkins

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.

 https://cve.radiocsirt.org/vuln/euvd-2026-35790 EUVD-2026-35790 2026-10-07T23:11:57.209608+00:00 EUVD-2026-35790 https://cve.radiocsirt.org/vuln/fkie_cve-2020-2102 fkie_cve-2020-2102 2026-10-07T23:11:57.209623+00:00

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.

 https://cve.radiocsirt.org/vuln/ghsa-fj6f-6933-839j GHSA-fj6f-6933-839j — Non-constant time HMAC comparison 2026-10-07T23:11:57.209644+00:00

Affected: Maven: org.jenkins-ci.main:jenkins-core

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not use a constant-time comparison when checking whether two HMACs are equal. This could potentially allow attackers to use statistical methods to obtain a valid HMAC for an attacker-controlled input value.

Jenkins 2.219, LTS 2.204.2 now uses a constant-time comparison when validating HMACs.

 https://cve.radiocsirt.org/vuln/gsd-2020-2102 gsd-2020-2102 2026-10-07T23:11:57.209667+00:00 gsd-2020-2102 https://cve.radiocsirt.org/vuln/rhba-2020:0402 RHBA-2020:0402 — Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update 2026-10-07T23:11:57.209679+00:00

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection jenkins: Inbound TCP Agent Protocol/3 authentication bypass jenkins: UDP multicast/broadcast service amplification reflection attack jenkins: Non-constant time comparison of inbound TCP agent connection secret jenkins: Non-constant time HMAC comparison jenkins: Exposed session identifiers on user detail object in the whoAmI diagnostic page jenkins: Memory usage graphs accessible to anyone with Overall/Read jenkins: REST APIs vulnerable to clickjacking