https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:01:35.099273+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-236061 EUVD-2026-236061 2026-10-03T19:01:35.103323+00:00 EUVD-2026-236061 https://cve.radiocsirt.org/vuln/fkie_cve-2022-45385 fkie_cve-2022-45385 2026-10-03T19:01:35.103359+00:00

A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.

 https://cve.radiocsirt.org/vuln/ghsa-v535-pc6r-77qh GHSA-v535-pc6r-77qh — Lack of authentication mechanism for webhook in CloudBees Docker Hub/Registry Notification Plugin 2026-10-03T19:01:35.103408+00:00

Affected: Maven: org.jenkins-ci.plugins:dockerhub-notification

CloudBees Docker Hub/Registry Notification Plugin provides several webhook endpoints that can be used to trigger builds when Docker images used by a job have been rebuilt.

In CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier, these endpoints can be accessed without authentication.

This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.

CloudBees Docker Hub/Registry Notification Plugin 2.6.2.1 requires a token as a part of webhook URLs, which will act as authentication for the webhook endpoint. As a result, all webhook URLs in the plugin will be different after updating the plugin.

Administrators can set the [Java system](https://www.jenkins.io/doc/book/managing/system-properties/) property `org.jenkinsci.plugins.registry.notification.webhook.JSONWebHook.DO_NOT_REQUIRE_API_TOKEN` to `true` to disable this fix.

 https://cve.radiocsirt.org/vuln/gsd-2022-45385 gsd-2022-45385 2026-10-03T19:01:35.103462+00:00 gsd-2022-45385 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-2056 WID-SEC-W-2022-2056 — Jenkins: Mehrere Schwachstellen 2026-10-03T19:01:35.103475+00:00

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in verschiedenen Jenkins Plugins ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Cross-Site-Scripting-Angriff durchzuführen.