https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T19:42:37.445596+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2020-02700 bdu:2020-02700 2026-10-05T19:42:37.522320+00:00 bdu:2020-02700 https://cve.radiocsirt.org/vuln/bit-jenkins-2020-2160 BIT-jenkins-2020-2160 2026-10-05T19:42:37.522362+00:00

Affected: Bitnami: jenkins

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.

 https://cve.radiocsirt.org/vuln/cnvd-2020-20705 cnvd-2020-20705 2026-10-05T19:42:37.522400+00:00 cnvd-2020-20705 https://cve.radiocsirt.org/vuln/euvd-2026-35835 EUVD-2026-35835 2026-10-05T19:42:37.522414+00:00 EUVD-2026-35835 https://cve.radiocsirt.org/vuln/fkie_cve-2020-2160 fkie_cve-2020-2160 2026-10-05T19:42:37.522426+00:00

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.

 https://cve.radiocsirt.org/vuln/ghsa-c735-g9f2-2mvp GHSA-c735-g9f2-2mvp — Cross-Site Request Forgery in Jenkins 2026-10-05T19:42:37.522447+00:00

Affected: Maven: org.jenkins-ci.main:jenkins-core

An extension point in Jenkins allows selectively disabling cross-site request forgery (CSRF) protection for specific URLs.

Implementations of that extension point received a different representation of the URL path than the Stapler web framework uses to dispatch requests in Jenkins 2.227 and earlier, LTS 2.204.5 and earlier. This discrepancy allowed attackers to craft URLs that would bypass the CSRF protection of any target URL.

Jenkins now uses the same representation of the URL path to decide whether CSRF protection is needed for a given URL as the Stapler web framework uses.

In case of problems, administrators can disable this security fix by setting the system property `hudson.security.csrf.CrumbFilter.UNPROCESSED_PATHINFO` to `true`.

As an additional safeguard, semicolon (`;`) characters in the path part of a URL are now banned by default. Administrators can disable this protection by setting the system property `jenkins.security.SuspiciousRequestFilter.allowSemicolonsInPath` to `true`.

 https://cve.radiocsirt.org/vuln/gsd-2020-2160 gsd-2020-2160 2026-10-05T19:42:37.522480+00:00 gsd-2020-2160 https://cve.radiocsirt.org/vuln/rhba-2020:2435 RHBA-2020:2435 — Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.25 packages update 2026-10-05T19:42:37.522491+00:00

jenkins: CSRF protection bypass via crafted URLs jenkins: XSS in job configuration pages jenkins: Content-Security-Policy headers for files uploaded leads to XSS jenkins: improperly processes HTML content of list leads to XSS