https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:00:23.658094+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2021-31169 cnvd-2021-31169 2026-10-03T19:00:23.793585+00:00 cnvd-2021-31169 https://cve.radiocsirt.org/vuln/euvd-2026-22334 EUVD-2026-22334 2026-10-03T19:00:23.793639+00:00 EUVD-2026-22334 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21643 fkie_cve-2021-21643 2026-10-03T19:00:23.793654+00:00

Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.

 https://cve.radiocsirt.org/vuln/ghsa-3m3f-2323-64m7 GHSA-3m3f-2323-64m7 — Incorrect permission checks in Jenkins Config File Provider Plugin allow enumerating credentials IDs 2026-10-03T19:00:23.793685+00:00

Affected: Maven: org.jenkins-ci.plugins:config-file-provider

Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints.

This allows attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of system-scoped credentials IDs in Jenkins Config File Provider Plugin 3.7.1 requires Overall/Administer permission.

 https://cve.radiocsirt.org/vuln/gsd-2021-21643 gsd-2021-21643 2026-10-03T19:00:23.793713+00:00 gsd-2021-21643 https://cve.radiocsirt.org/vuln/rhba-2021:2407 RHBA-2021:2407 — Red Hat Bug Fix Advisory: OpenShift Container Platform 4.6.35 packages update 2026-10-03T19:00:23.793725+00:00

jenkins-2-plugins/config-file-provider: Does not configure its XML parser to prevent XML external entity (XXE) attacks. jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP endpoints. jenkins-2-plugins/config-file-provider: does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. jenkins-2-plugins/config-file-provider: Does not perform permission checks in several HTTP endpoints.