https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T17:26:06.054369+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-61964 cnvd-2020-61964 2026-10-03T17:26:06.138660+00:00 cnvd-2020-61964 https://cve.radiocsirt.org/vuln/euvd-2026-35987 EUVD-2026-35987 2026-10-03T17:26:06.138706+00:00 EUVD-2026-35987 https://cve.radiocsirt.org/vuln/fkie_cve-2020-2305 fkie_cve-2020-2305 2026-10-03T17:26:06.138720+00:00

Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

 https://cve.radiocsirt.org/vuln/ghsa-x58r-wxc3-7pqr GHSA-x58r-wxc3-7pqr — XXE vulnerability in Jenkins Mercurial Plugin 2026-10-03T17:26:06.138751+00:00

Affected: Maven: org.jenkins-ci.plugins:mercurial

Jenkins Mercurial Plugin prior to 2.12, 2.10.1, 2.9.1, and 2.8.1 does not configure its XML changelog parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Mercurial Plugin 2.12, 2.10.1, 2.9.1, and 2.8.1 disables external entity resolution for its XML parser.

 https://cve.radiocsirt.org/vuln/gsd-2020-2305 gsd-2020-2305 2026-10-03T17:26:06.138781+00:00 gsd-2020-2305 https://cve.radiocsirt.org/vuln/rhsa-2021:0034 RHSA-2021:0034 — Red Hat Security Advisory: OpenShift Container Platform 4.5.27 packages and security update 2026-10-03T17:26:06.138793+00:00

jenkins-2-plugins/subversion: XML parser is not preventing XML external entity (XXE) attacks jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint could result in information disclosure jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes Plugin jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows listing pod templates jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows enumerating credentials IDs python-urllib3: CRLF injection via HTTP request method