https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T10:54:40.732427+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-jenkins-2022-34173 BIT-jenkins-2022-34173 2026-10-03T10:54:40.794338+00:00

Affected: Bitnami: jenkins

In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

 https://cve.radiocsirt.org/vuln/euvd-2026-17754 EUVD-2026-17754 2026-10-03T10:54:40.794392+00:00 EUVD-2026-17754 https://cve.radiocsirt.org/vuln/fkie_cve-2022-34173 fkie_cve-2022-34173 2026-10-03T10:54:40.794409+00:00

In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

 https://cve.radiocsirt.org/vuln/ghsa-6g4r-q7qg-6qx6 GHSA-6g4r-q7qg-6qx6 — Cross-site Scripting vulnerability in Jenkins 2026-10-03T10:54:40.794434+00:00

Affected: Maven: org.jenkins-ci.main:jenkins-core

Since Jenkins 2.340, the tooltip of the build button in list views supports HTML without escaping the job display name.

This vulnerability is known to be exploitable by attackers with Job/Configure permission.

Jenkins 2.356 addresses this vulnerability. The tooltip of the build button in list views is now escaped.

No Jenkins LTS release is affected by SECURITY-2776 or SECURITY-2780, as these were not present in Jenkins 2.332.x and fixed in the 2.346.x line before 2.346.1.

 https://cve.radiocsirt.org/vuln/gsd-2022-34173 gsd-2022-34173 2026-10-03T10:54:40.794461+00:00 gsd-2022-34173 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0445 WID-SEC-W-2022-0445 — Jenkins: Mehrere Schwachstellen 2026-10-03T10:54:40.794473+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion.