https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:08:08.251948+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-19677 EUVD-2026-19677 2026-10-03T04:08:08.303190+00:00 EUVD-2026-19677 https://cve.radiocsirt.org/vuln/fkie_cve-2022-45379 fkie_cve-2022-45379 2026-10-03T04:08:08.303238+00:00

Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to collision attacks.

 https://cve.radiocsirt.org/vuln/ghsa-fv42-mx39-6fpw GHSA-fv42-mx39-6fpw — Whole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions 2026-10-03T04:08:08.303270+00:00

Affected: Maven: org.jenkins-ci.plugins:script-security

Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the [SHA-1 hash](https://en.wikipedia.org/wiki/SHA-1) of the approved script. SHA-1 no longer meets the security standards for producing a cryptographically secure message digest.

Script Security Plugin 1190.v65867a_a_47126 uses SHA-512 for new whole-script approvals. Previously approved scripts will have their SHA-1 based whole-script approval replaced with a corresponding SHA-512 whole-script approval when the script is next used.

Whole-script approval only stores the SHA-1 or SHA-512 hash, so it is not possible to migrate all previously approved scripts automatically on startup.

Administrators concerned about SHA-1 collision attacks on the whole-script approval feature are able to revoke all previous (SHA-1) script approvals on the In-Process Script Approval page.

 https://cve.radiocsirt.org/vuln/gsd-2022-45379 gsd-2022-45379 2026-10-03T04:08:08.303300+00:00 gsd-2022-45379 https://cve.radiocsirt.org/vuln/rhsa-2023:0560 RHSA-2023:0560 — Red Hat Security Advisory: OpenShift Container Platform 4.10.51 security update 2026-10-03T04:08:08.303312+00:00

google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization snakeyaml: Denial of Service due to missing nested depth limitation for collections plugin: CSRF vulnerability in Script Security Plugin plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin plugin: CSRF vulnerability in Blue Ocean Plugin plugin: missing permission checks in Blue Ocean Plugin jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git plugin: Lack of authentication mechanism in Git Plugin webhook plugin: Lack of authentication mechanism in Git Plugin webhook plugin: Non-constant time webhook signature comparison in GitHub Plugin jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin jenkins-plugin/pipeline-stage-view: CSRF p…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-2056 WID-SEC-W-2022-2056 — Jenkins: Mehrere Schwachstellen 2026-10-03T04:08:08.303355+00:00

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in verschiedenen Jenkins Plugins ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Cross-Site-Scripting-Angriff durchzuführen.