https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T08:37:58.067250+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-59712 cnvd-2020-59712 2026-10-17T08:37:58.140860+00:00 cnvd-2020-59712 https://cve.radiocsirt.org/vuln/euvd-2026-35980 EUVD-2026-35980 2026-10-17T08:37:58.140905+00:00 EUVD-2026-35980 https://cve.radiocsirt.org/vuln/fkie_cve-2020-2253 fkie_cve-2020-2253 2026-10-17T08:37:58.140920+00:00

Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server.

 https://cve.radiocsirt.org/vuln/ghsa-4qrj-99r6-jfrh GHSA-4qrj-99r6-jfrh — Missing hostname validation in Email Extension Plugin 2026-10-17T08:37:58.140951+00:00

Affected: Maven: org.jenkins-ci.plugins:email-ext

Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.

Email Extension Plugin 2.76 validates the SMTP hostname when connecting via TLS by default. In Email Extension Plugin 2.75 and earlier, administrators can set the Java system property `mail.smtp.ssl.checkserveridentity` to `true` on startup to enable this protection. Alternatively, this protection can be enabled (or disabled in the new version) via the 'Advanced Email Properties' field in the plugin’s configuration in Configure System.

In case of problems, this protection can be disabled again by setting `mail.smtp.ssl.checkserveridentity` to `false` using either method.

 https://cve.radiocsirt.org/vuln/gsd-2020-2253 gsd-2020-2253 2026-10-17T08:37:58.140986+00:00 gsd-2020-2253