https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T17:53:28.211920+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2021-31660 cnvd-2021-31660 2026-10-03T17:53:28.344323+00:00 cnvd-2021-31660 https://cve.radiocsirt.org/vuln/euvd-2026-22312 EUVD-2026-22312 2026-10-03T17:53:28.344376+00:00 EUVD-2026-22312 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21644 fkie_cve-2021-21644 2026-10-03T17:53:28.344391+00:00

A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID.

 https://cve.radiocsirt.org/vuln/ghsa-998m-f2x3-jjq4 GHSA-998m-f2x3-jjq4 — CSRF vulnerability in Jenkins Config File Provider Plugin allows deleting configuration files 2026-10-03T17:53:28.344420+00:00

Affected: Maven: org.jenkins-ci.plugins:config-file-provider

Jenkins Config File Provider Plugin 3.7.0 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to delete configuration files corresponding to an attacker-specified ID.

This is due to an incomplete fix of [SECURITY-938](https://www.jenkins.io/security/advisory/2018-09-25/#SECURITY-938).

Jenkins Config File Provider Plugin 3.7.1 requires POST requests for the affected HTTP endpoint.

 https://cve.radiocsirt.org/vuln/gsd-2021-21644 gsd-2021-21644 2026-10-03T17:53:28.344449+00:00 gsd-2021-21644 https://cve.radiocsirt.org/vuln/rhba-2021:2407 RHBA-2021:2407 — Red Hat Bug Fix Advisory: OpenShift Container Platform 4.6.35 packages update 2026-10-03T17:53:28.344462+00:00

jenkins-2-plugins/config-file-provider: Does not configure its XML parser to prevent XML external entity (XXE) attacks. jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP endpoints. jenkins-2-plugins/config-file-provider: does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. jenkins-2-plugins/config-file-provider: Does not perform permission checks in several HTTP endpoints.