https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T06:12:26.016737+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2022-49959 cnvd-2022-49959 2026-10-03T06:12:26.097577+00:00 cnvd-2022-49959 https://cve.radiocsirt.org/vuln/euvd-2026-16702 EUVD-2026-16702 2026-10-03T06:12:26.097619+00:00 EUVD-2026-16702 https://cve.radiocsirt.org/vuln/fkie_cve-2022-30948 fkie_cve-2022-30948 2026-10-03T06:12:26.097635+00:00

Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.

 https://cve.radiocsirt.org/vuln/ghsa-5786-3qjg-mr88 GHSA-5786-3qjg-mr88 — Path traversal in Jenkins Mercurial Plugin 2026-10-03T06:12:26.097667+00:00

Affected: Maven: org.jenkins-ci.plugins:mercurial

SCMs support a number of different URL schemes, including local file system paths (e.g. using file: URLs).

Historically in Jenkins, only agents checked out from SCM, and if multiple projects share the same agent, there is no expected isolation between builds besides using different workspaces unless overridden. Some Pipeline-related features check out SCMs from the Jenkins controller as well.

This allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller’s file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents

 https://cve.radiocsirt.org/vuln/gsd-2022-30948 gsd-2022-30948 2026-10-03T06:12:26.097702+00:00 gsd-2022-30948 https://cve.radiocsirt.org/vuln/rhsa-2023:0017 RHSA-2023:0017 — Red Hat Security Advisory: OpenShift Container Platform 4.8.56 packages and security update 2026-10-03T06:12:26.097715+00:00

http2-server: Invalid HTTP/2 requests cause DoS Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin plugin: Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Pipeline: Groovy Plugin plugin: CSRF vulnerability in Script Security Plugin plugin: Mercurial SCM plugin can check out from the controller file system plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin plugin: CSRF vulnerability in Blue Ocean Plugin plugin: missing permission checks in Blue Ocean Plugin jenkins: Observable timing discrepancy allows determining username validity jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git plugin: Lack of authentication mechanism in Git Plugin webhook plugin: Lack of authentication mechanism in Git Plugin webhook plugin: Non-constant time webhook signature comparison in GitHub Plugin

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0090 WID-SEC-W-2023-0090 — Jenkins: Mehrere Schwachstellen 2026-10-03T06:12:26.097753+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.