https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T05:16:38.899374+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2022-79933 cnvd-2022-79933 2026-10-03T05:16:38.975922+00:00 cnvd-2022-79933 https://cve.radiocsirt.org/vuln/euvd-2026-15985 EUVD-2026-15985 2026-10-03T05:16:38.975974+00:00 EUVD-2026-15985 https://cve.radiocsirt.org/vuln/fkie_cve-2022-29043 fkie_cve-2022-29043 2026-10-03T05:16:38.975997+00:00

Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

 https://cve.radiocsirt.org/vuln/ghsa-pjm3-f4vh-3h3h GHSA-pjm3-f4vh-3h3h — Stored Cross-site Scripting in Jenkins Mask Passwords Plugin 2026-10-03T05:16:38.976047+00:00

Affected: Maven: org.jenkins-ci.plugins:mask-passwords

Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix.

 https://cve.radiocsirt.org/vuln/gsd-2022-29043 gsd-2022-29043 2026-10-03T05:16:38.976095+00:00 gsd-2022-29043 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0265 WID-SEC-W-2022-0265 — Jenkins: Mehrere Schwachstellen 2026-10-03T05:16:38.976114+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, einen Cross-Site-Scripting-Angriff durchzuführen und Dateien zu manipulieren.