https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:30:44.520098+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-jenkins-2021-21609 BIT-jenkins-2021-21609 2026-10-03T04:30:44.624790+00:00

Affected: Bitnami: jenkins

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did have Overall/Read permission.

 https://cve.radiocsirt.org/vuln/cnvd-2021-04651 cnvd-2021-04651 2026-10-03T04:30:44.624860+00:00 cnvd-2021-04651 https://cve.radiocsirt.org/vuln/euvd-2026-22307 EUVD-2026-22307 2026-10-03T04:30:44.624878+00:00 EUVD-2026-22307 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21609 fkie_cve-2021-21609 2026-10-03T04:30:44.624901+00:00

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did have Overall/Read permission.

 https://cve.radiocsirt.org/vuln/ghsa-4625-q52w-39cx GHSA-4625-q52w-39cx — Missing permission check for paths with specific prefix in Jenkins 2026-10-03T04:30:44.624923+00:00

Affected: Maven: org.jenkins-ci.main:jenkins-core

Jenkins includes a static list of URLs that are always accessible even without Overall/Read permission, such as the login form. These URLs are excluded from an otherwise universal permission check.

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly compare requested URLs with that list.

This allows attackers without Overall/Read permission to access plugin-provided URLs with any of the following prefixes if no other permissions are required: - `accessDenied` - `error` - `instance-identity` - `login` - `logout` - `oops` - `securityRealm` - `signup` - `tcpSlaveAgentListener`

For example, a plugin contributing the path `loginFoo/` would have URLs in that space accessible without the default Overall/Read permission check.

The Jenkins security team is not aware of any affected plugins as of the publication of this advisory.

The comparison of requested URLs with the list of always accessible URLs has been fixed to only allow access to the specific listed URLs in Jenkins 2.275, LTS 2.263.2.

In case this change causes problems, additional paths can be made accessible without Overall/Read permissions: The [Java system property](https://www.jenkins.io/doc/book/managing/system-properties/) `jenkins.model.Jenkins.additionalReadablePaths` is a comma-separated list of additional path prefixes to allow access to.

 https://cve.radiocsirt.org/vuln/gsd-2021-21609 gsd-2021-21609 2026-10-03T04:30:44.624959+00:00 gsd-2021-21609 https://cve.radiocsirt.org/vuln/rhsa-2021:0423 RHSA-2021:0423 — Red Hat Security Advisory: OpenShift Container Platform 4.6.17 security and packages update 2026-10-03T04:30:44.624972+00:00

ant: insecure temporary file vulnerability ant: insecure temporary file jenkins: Arbitrary file read vulnerability in workspace browsers jenkins: XSS vulnerability in notification bar jenkins: Improper handling of REST API XML deserialization errors jenkins: Path traversal vulnerability in agent names jenkins: Arbitrary file existence check in file fingerprints jenkins: Excessive memory allocation in graph URLs leads to denial of service jenkins: Stored XSS vulnerability in button labels jenkins: Missing permission check for paths with specific prefix jenkins: Reflected XSS vulnerability in markup formatter preview jenkins: Stored XSS vulnerability on new item page jenkins: Filesystem traversal by privileged users