https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T16:26:59.047839+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-216985 EUVD-2026-216985 2026-10-15T16:26:59.050936+00:00 EUVD-2026-216985 https://cve.radiocsirt.org/vuln/fkie_cve-2023-50767 fkie_cve-2023-50767 2026-10-15T16:26:59.050966+00:00

Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML.

 https://cve.radiocsirt.org/vuln/ghsa-9vrm-747r-668v GHSA-9vrm-747r-668v — Jenkins Nexus Platform Plugin missing permission check 2026-10-15T16:26:59.050995+00:00

Affected: Maven: org.sonatype.nexus.ci:nexus-jenkins-plugin

Jenkins Nexus Platform Plugin 3.18.0-03 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML.

Additionally, the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, so attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Nexus Platform Plugin 3.18.1-01 configures its XML parser to prevent XML external entity (XXE) attacks.

Additionally, POST requests and Overall/Administer permission are required for the affected HTTP endpoints.

 https://cve.radiocsirt.org/vuln/gsd-2023-50767 gsd-2023-50767 2026-10-15T16:26:59.051026+00:00 gsd-2023-50767 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-3152 WID-SEC-W-2023-3152 — Jenkins Plugins: Mehrere Schwachstellen 2026-10-15T16:26:59.051039+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Jenkins Plugins ausnutzen, um einen CSRF-Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder Dateien zu manipulieren.