https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:05:15.927851+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-jenkins-2022-34171 BIT-jenkins-2022-34171 2026-10-03T14:05:15.988954+00:00

Affected: Bitnami: jenkins

In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.

 https://cve.radiocsirt.org/vuln/euvd-2026-17767 EUVD-2026-17767 2026-10-03T14:05:15.989012+00:00 EUVD-2026-17767 https://cve.radiocsirt.org/vuln/fkie_cve-2022-34171 fkie_cve-2022-34171 2026-10-03T14:05:15.989029+00:00

In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-7f84-p6r5-jr6q GHSA-7f84-p6r5-jr6q — Cross-site Scripting vulnerability in Jenkins 2026-10-03T14:05:15.989056+00:00

Affected: Maven: org.jenkins-ci.main:jenkins-core

Since Jenkins 2.321 and LTS 2.332.1, the HTML output generated for new symbol-based SVG icons includes the `title` attribute of `l:ionicon` until Jenkins 2.334 and `alt` attribute of `l:icon` since Jenkins 2.335 without further escaping.

This vulnerability is known to be exploitable by attackers with Job/Configure permission.

Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability, the `title` attribute of `l:ionicon` (Jenkins LTS 2.332.4) and `alt` attribute of `l:icon` (Jenkins 2.356 and LTS 2.346.1) are escaped in the generated HTML output.

 https://cve.radiocsirt.org/vuln/gsd-2022-34171 gsd-2022-34171 2026-10-03T14:05:15.989084+00:00 gsd-2022-34171 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0445 WID-SEC-W-2022-0445 — Jenkins: Mehrere Schwachstellen 2026-10-03T14:05:15.989096+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion.