https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:42:35.958502+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-238483 EUVD-2026-238483 2026-10-03T03:42:36.021613+00:00 EUVD-2026-238483 https://cve.radiocsirt.org/vuln/fkie_cve-2022-43435 fkie_cve-2022-43435 2026-10-03T03:42:36.021649+00:00

Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.

 https://cve.radiocsirt.org/vuln/ghsa-7rrj-hqv6-fvpp GHSA-7rrj-hqv6-fvpp — Content-Security-Policy protection for user content can be disabled in Jenkins 360 FireLine Plugin 2026-10-03T03:42:36.021681+00:00

Affected: Maven: org.jenkins-ci.plugins.plugin:fireline

Jenkins sets the Content-Security-Policy header to static files served by Jenkins (specifically `DirectoryBrowserSupport`), such as workspaces, `/userContent`, or archived artifacts, unless a Resource Root URL is specified.

360 FireLine Plugin 1.7.2 and earlier globally disables the `Content-Security-Policy` header for static files served by Jenkins whenever the 'Execute FireLine' build step is executed, if the option 'Open access to HTML with JS or CSS' is checked. This allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc.

Jenkins instances with [Resource Root URL](https://www.jenkins.io/doc/book/security/user-content/#resource-root-url) configured are unaffected.

 https://cve.radiocsirt.org/vuln/gsd-2022-43435 gsd-2022-43435 2026-10-03T03:42:36.021783+00:00 gsd-2022-43435 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1804 WID-SEC-W-2022-1804 — Jenkins Plugins: Mehrere Schwachstellen 2026-10-03T03:42:36.021799+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Jenkins Plugins ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen oder Sicherheitsvorkehrungen zu umgehen.