https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:37:20.362730+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-193935 EUVD-2026-193935 2026-10-03T07:37:20.438079+00:00 EUVD-2026-193935 https://cve.radiocsirt.org/vuln/fkie_cve-2023-40341 fkie_cve-2023-40341 2026-10-03T07:37:20.438118+00:00

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job.

 https://cve.radiocsirt.org/vuln/ghsa-g4pq-p927-7pgg GHSA-g4pq-p927-7pgg — Jenkins Blue Ocean Plugin cross-site request forgery vulnerability 2026-10-03T07:37:20.438151+00:00

Affected: Maven: io.jenkins.blueocean:blueocean

Jenkins Blue Ocean Plugin 1.27.5 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job.

This issue is due to an incomplete fix of SECURITY-2502.

Blue Ocean Plugin 1.27.5.1 uses the configured SCM URL, instead of a user-specified URL provided as a parameter to the HTTP endpoint.

 https://cve.radiocsirt.org/vuln/gsd-2023-40341 gsd-2023-40341 2026-10-03T07:37:20.438179+00:00 gsd-2023-40341 https://cve.radiocsirt.org/vuln/rhsa-2024:0777 RHSA-2024:0777 — Red Hat Security Advisory: jenkins and jenkins-2-plugins security update 2026-10-03T07:37:20.438192+00:00

snakeyaml: Denial of Service due to missing nested depth limitation for collections maven-shared-utils: Command injection via Commandline class apache-commons-text: variable interpolation RCE guava: insecure temporary directory creation jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin jackson-databind: denial of service via cylic dependencies Jenkins: Session fixation vulnerability in OpenShift Login Plugin Jenkins: Open redirect vulnerability in OpenShift Login Plugin golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin may approve unsandboxed scripts jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin jenkins-plugins: cloudbees-folder: Information disclosure in Folders Plugin jenkins-plugins: config-file-provider: Improper masking of credentials in Config File Provider Plugin jenkins-plugins: blueocean: CSRF vulnerability in Blue Ocean Plugin allows capturing credentials HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2088 WID-SEC-W-2023-2088 — Jenkins: Mehrere Schwachstellen 2026-10-03T07:37:20.438228+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen.