https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T04:58:21.039353+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-jenkins-2021-21610 BIT-jenkins-2021-21610 2026-10-04T04:58:21.158258+00:00

Affected: Bitnami: jenkins

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup.

 https://cve.radiocsirt.org/vuln/cnvd-2021-04646 cnvd-2021-04646 2026-10-04T04:58:21.158324+00:00 cnvd-2021-04646 https://cve.radiocsirt.org/vuln/euvd-2026-22296 EUVD-2026-22296 2026-10-04T04:58:21.158342+00:00 EUVD-2026-22296 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21610 fkie_cve-2021-21610 2026-10-04T04:58:21.158354+00:00

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup.

 https://cve.radiocsirt.org/vuln/ghsa-7qf3-c2q8-69m3 GHSA-7qf3-c2q8-69m3 — Reflected XSS vulnerability in Jenkins markup formatter preview 2026-10-04T04:58:21.158376+00:00

Affected: Maven: org.jenkins-ci.main:jenkins-core

Jenkins allows administrators to choose the markup formatter to use for descriptions of jobs, builds, views, etc. displayed in Jenkins. When editing such a description, users can choose to have Jenkins render a formatted preview of the description they entered.

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering the formatted preview of markup passed as a query parameter. This results in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup, like [Anything Goes Formatter Plugin](https://plugins.jenkins.io/anything-goes-formatter/).

Jenkins 2.275, LTS 2.263.2 requires that preview URLs are accessed using POST and sets Content-Security-Policy headers that prevent execution of unsafe elements when the URL is accessed directly.

In case of problems with this change, these protections can be disabled by setting the [Java system properties](https://www.jenkins.io/doc/book/managing/system-properties/) `hudson.markup.MarkupFormatter.previewsAllowGET` to `true` and/or `hudson.markup.MarkupFormatter.previewsSetCSP` to `false`. Doing either is discouraged.

 https://cve.radiocsirt.org/vuln/gsd-2021-21610 gsd-2021-21610 2026-10-04T04:58:21.158438+00:00 gsd-2021-21610 https://cve.radiocsirt.org/vuln/rhsa-2021:0423 RHSA-2021:0423 — Red Hat Security Advisory: OpenShift Container Platform 4.6.17 security and packages update 2026-10-04T04:58:21.158465+00:00

ant: insecure temporary file vulnerability ant: insecure temporary file jenkins: Arbitrary file read vulnerability in workspace browsers jenkins: XSS vulnerability in notification bar jenkins: Improper handling of REST API XML deserialization errors jenkins: Path traversal vulnerability in agent names jenkins: Arbitrary file existence check in file fingerprints jenkins: Excessive memory allocation in graph URLs leads to denial of service jenkins: Stored XSS vulnerability in button labels jenkins: Missing permission check for paths with specific prefix jenkins: Reflected XSS vulnerability in markup formatter preview jenkins: Stored XSS vulnerability on new item page jenkins: Filesystem traversal by privileged users