https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T21:00:11.963177+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-jenkins-2020-2105 BIT-jenkins-2020-2105 2026-10-07T21:00:12.046486+00:00

Affected: Bitnami: jenkins

REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.

 https://cve.radiocsirt.org/vuln/euvd-2026-35815 EUVD-2026-35815 2026-10-07T21:00:12.046542+00:00 EUVD-2026-35815 https://cve.radiocsirt.org/vuln/fkie_cve-2020-2105 fkie_cve-2020-2105 2026-10-07T21:00:12.046557+00:00

REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.

 https://cve.radiocsirt.org/vuln/ghsa-7xp8-7wqx-5hqx GHSA-7xp8-7wqx-5hqx — Jenkins REST APIs vulnerable to clickjacking 2026-10-07T21:00:12.046579+00:00

Affected: Maven: org.jenkins-ci.main:jenkins-core

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not serve the `X-Frame-Options: deny` HTTP header on REST API responses to protect against clickjacking attacks. An attacker could exploit this by routing the victim through a specially crafted web page that embeds a REST API endpoint in an iframe and tricking the user into performing an action which would allow for the attacker to learn the content of that REST API endpoint.

Jenkins 2.219, LTS 2.204.2 now adds the `X-Frame-Options: deny` HTTP header to REST API responses, which prevents these types of clickjacking attacks.

 https://cve.radiocsirt.org/vuln/gsd-2020-2105 gsd-2020-2105 2026-10-07T21:00:12.046605+00:00 gsd-2020-2105 https://cve.radiocsirt.org/vuln/rhba-2020:0402 RHBA-2020:0402 — Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update 2026-10-07T21:00:12.046617+00:00

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection jenkins: Inbound TCP Agent Protocol/3 authentication bypass jenkins: UDP multicast/broadcast service amplification reflection attack jenkins: Non-constant time comparison of inbound TCP agent connection secret jenkins: Non-constant time HMAC comparison jenkins: Exposed session identifiers on user detail object in the whoAmI diagnostic page jenkins: Memory usage graphs accessible to anyone with Overall/Read jenkins: REST APIs vulnerable to clickjacking