https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T15:15:47.457473+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-04086 bdu:2023-04086 2026-10-03T15:15:47.559100+00:00 bdu:2023-04086 https://cve.radiocsirt.org/vuln/euvd-2026-211551 EUVD-2026-211551 2026-10-03T15:15:47.559139+00:00 EUVD-2026-211551 https://cve.radiocsirt.org/vuln/fkie_cve-2023-32994 fkie_cve-2023-32994 2026-10-03T15:15:47.559155+00:00

Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections.

 https://cve.radiocsirt.org/vuln/ghsa-9m92-qwpc-qm78 GHSA-9m92-qwpc-qm78 — Jenkins SAML Single Sign On(SSO) Plugin unconditionally disables SSL/TLS certificate validation 2026-10-03T15:15:47.559186+00:00

Affected: Maven: io.jenkins.plugins:miniorange-saml-sp

Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.

SAML Single Sign On(SSO) Plugin 2.2.0 performs SSL/TLS certificate validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata.

 https://cve.radiocsirt.org/vuln/gsd-2023-32994 gsd-2023-32994 2026-10-03T15:15:47.559226+00:00 gsd-2023-32994 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1228 WID-SEC-W-2023-1228 — Jenkins Plugins: Mehrere Schwachstellen ermöglichen Manipulation von Dateien 2026-10-03T15:15:47.559255+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Jenkins Plugins ausnutzen, um einen Cross-Site-Scripting-Angriff-durchzuführen, Dateien zu manipulieren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Request-Forgery-Angriff durchzuführen.