https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T05:16:29.582231+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-33745 cnvd-2020-33745 2026-10-12T05:16:29.641881+00:00 cnvd-2020-33745 https://cve.radiocsirt.org/vuln/euvd-2026-35875 EUVD-2026-35875 2026-10-12T05:16:29.641912+00:00 EUVD-2026-35875 https://cve.radiocsirt.org/vuln/fkie_cve-2020-2197 fkie_cve-2020-2197 2026-10-12T05:16:29.641925+00:00

Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Project job configurations in XML format.

 https://cve.radiocsirt.org/vuln/ghsa-hj32-9mcw-5cwh GHSA-hj32-9mcw-5cwh — Missing permission check in Jenkins Project Inheritance Plugin 2026-10-12T05:16:29.641952+00:00

Affected: Maven: hudson.plugins:project-inheritance

Jenkins limits access to job configuration XML data (`config.xml`) to users with Job/ExtendedRead permission, typically implied by Job/Configure permission. Project Inheritance Plugin has several job inspection features, including the API URL `/job/…​/getConfigAsXML` for its Inheritance Project job type that does something similar.

Project Inheritance Plugin 21.04.03 and earlier does not check permissions for this new endpoint, granting access to job configuration XML data to every user with Job/Read permission.

Additionally, the encrypted values of secrets stored in the job configuration are not redacted, as they would be by the `config.xml` API for users without Job/Configure permission.

 https://cve.radiocsirt.org/vuln/gsd-2020-2197 gsd-2020-2197 2026-10-12T05:16:29.641983+00:00 gsd-2020-2197