https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T11:21:48.416973+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-jenkins-2023-35141 BIT-jenkins-2023-35141 2026-10-04T11:21:48.421080+00:00

Affected: Bitnami: jenkins

In Jenkins LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.

 https://cve.radiocsirt.org/vuln/euvd-2026-208661 EUVD-2026-208661 2026-10-04T11:21:48.421126+00:00 EUVD-2026-208661 https://cve.radiocsirt.org/vuln/fkie_cve-2023-35141 fkie_cve-2023-35141 2026-10-04T11:21:48.421142+00:00

In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.

 https://cve.radiocsirt.org/vuln/ghsa-98fp-r22g-wpj7 GHSA-98fp-r22g-wpj7 — Jenkins CSRF protection bypass vulnerability 2026-10-04T11:21:48.421164+00:00

Affected: Maven: org.jenkins-ci.main:jenkins-core

Jenkins provides context menus for various UI elements, like links to jobs and builds, or breadcrumbs.

In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint (e.g., the Script Console) by opening a context menu.

As of publication of this advisory, we are aware of insufficiently escaped context menu URLs for label expressions, allowing attackers with Item/Configure permissions to exploit this vulnerability.

Jenkins 2.400, LTS 2.401.1 sends GET requests to load the list of context actions.

 https://cve.radiocsirt.org/vuln/gsd-2023-35141 gsd-2023-35141 2026-10-04T11:21:48.421191+00:00 gsd-2023-35141 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1471 WID-SEC-W-2023-1471 — Jenkins Core und Jenkins Plugins: Mehrere Schwachstellen 2026-10-04T11:21:48.421203+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Cross-Site-Scripting-Angriff durchzuführen.