https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:59:44.655000+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-jenkins-2022-34174 BIT-jenkins-2022-34174 2026-10-03T11:59:44.743757+00:00

Affected: Bitnami: jenkins

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.

 https://cve.radiocsirt.org/vuln/euvd-2026-17760 EUVD-2026-17760 2026-10-03T11:59:44.743826+00:00 EUVD-2026-17760 https://cve.radiocsirt.org/vuln/fkie_cve-2022-34174 fkie_cve-2022-34174 2026-10-03T11:59:44.743849+00:00

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.

 https://cve.radiocsirt.org/vuln/ghsa-9grj-j43m-mjqr GHSA-9grj-j43m-mjqr — Observable timing discrepancy allows determining username validity in Jenkins 2026-10-03T11:59:44.743881+00:00

Affected: Maven: org.jenkins-ci.main:jenkins-core

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm. This allows attackers to determine the validity of attacker-specified usernames.

Login attempts with an invalid username now validate a synthetic password to eliminate the timing discrepancy in Jenkins 2.356, LTS 2.332.4.

 https://cve.radiocsirt.org/vuln/gsd-2022-34174 gsd-2022-34174 2026-10-03T11:59:44.743918+00:00 gsd-2022-34174 https://cve.radiocsirt.org/vuln/rhsa-2023:0017 RHSA-2023:0017 — Red Hat Security Advisory: OpenShift Container Platform 4.8.56 packages and security update 2026-10-03T11:59:44.743936+00:00

http2-server: Invalid HTTP/2 requests cause DoS Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin plugin: Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Pipeline: Groovy Plugin plugin: CSRF vulnerability in Script Security Plugin plugin: Mercurial SCM plugin can check out from the controller file system plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin plugin: CSRF vulnerability in Blue Ocean Plugin plugin: missing permission checks in Blue Ocean Plugin jenkins: Observable timing discrepancy allows determining username validity jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git plugin: Lack of authentication mechanism in Git Plugin webhook plugin: Lack of authentication mechanism in Git Plugin webhook plugin: Non-constant time webhook signature comparison in GitHub Plugin

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0445 WID-SEC-W-2022-0445 — Jenkins: Mehrere Schwachstellen 2026-10-03T11:59:44.743988+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion.