https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T12:04:21.049452+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-jenkins-2023-27900 BIT-jenkins-2023-27900 2026-10-03T12:04:21.124635+00:00

Affected: Bitnami: jenkins

Jenkins LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service.

 https://cve.radiocsirt.org/vuln/euvd-2026-219963 EUVD-2026-219963 2026-10-03T12:04:21.124696+00:00 EUVD-2026-219963 https://cve.radiocsirt.org/vuln/fkie_cve-2023-27900 fkie_cve-2023-27900 2026-10-03T12:04:21.124713+00:00

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service.

 https://cve.radiocsirt.org/vuln/ghsa-frgr-c5f2-8qhh GHSA-frgr-c5f2-8qhh — Denial of service in Jenkins Core 2026-10-03T12:04:21.124737+00:00

Affected: Maven: org.jenkins-ci.main:jenkins-core

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and prior to LTS 2.387.1 is affected by the Apache Commons FileUpload library’s vulnerability CVE-2023-24998. This library is used to process uploaded files via the Stapler web framework (usually through StaplerRequest#getFile) and MultipartFormDataParser in Jenkins.

This allows attackers to cause a denial of service (DoS) by sending crafted requests to HTTP endpoints processing file uploads.

Jenkins 2.394, LTS 2.375.4, and LTS 2.387.1 limits the number of request parts to be processed to 1000. Specific endpoints receiving only simple form submissions have a lower limit.

 https://cve.radiocsirt.org/vuln/gsd-2023-27900 gsd-2023-27900 2026-10-03T12:04:21.124769+00:00 gsd-2023-27900 https://cve.radiocsirt.org/vuln/rhsa-2023:3299 RHSA-2023:3299 — Red Hat Security Advisory: jenkins and jenkins-2-plugins security update 2026-10-03T12:04:21.124781+00:00

google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization kubernetes-client: Insecure deserialization in unmarshalYaml method jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode springframework: Authorization Bypass in RegexRequestMatcher com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks apache-commons-text: variable interpolation RCE jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin FileUpload: FileUpload DoS with excessive parts jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin Jenkins: Denial of Service attack Jenkins: Denial of Service attack Jenkins: Workspace temporary directories accessible through directory browser Jenkins: Information disclosure through error stack traces related to agents

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0609 WID-SEC-W-2023-0609 — Jenkins: Mehrere Schwachstellen 2026-10-03T12:04:21.124818+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Cross-Site-Scripting-Angriff durchzuführen und Code auszuführen