https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T08:24:24.150751+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-00751 bdu:2024-00751 2026-10-03T08:24:24.286317+00:00 bdu:2024-00751 https://cve.radiocsirt.org/vuln/bit-jenkins-2024-23898 BIT-jenkins-2024-23898 2026-10-03T08:24:24.286362+00:00

Affected: Bitnami: jenkins

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

 https://cve.radiocsirt.org/vuln/euvd-2026-245413 EUVD-2026-245413 2026-10-03T08:24:24.286397+00:00 EUVD-2026-245413 https://cve.radiocsirt.org/vuln/fkie_cve-2024-23898 fkie_cve-2024-23898 2026-10-03T08:24:24.286410+00:00

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

 https://cve.radiocsirt.org/vuln/ghsa-53ph-2r2x-vqw8 GHSA-53ph-2r2x-vqw8 — Cross-site WebSocket hijacking vulnerability in the Jenkins CLI 2026-10-03T08:24:24.286433+00:00

Affected: Maven: org.jenkins-ci.main:jenkins-core

Jenkins has a built-in command line interface (CLI) to access Jenkins from a script or shell environment. Since Jenkins 2.217 and LTS 2.222.1, one of the ways to communicate with the CLI is through a WebSocket endpoint. This endpoint relies on the default Jenkins web request authentication functionality, like HTTP Basic authentication with API tokens, or session cookies. This endpoint is enabled when running on a version of Jetty for which Jenkins supports WebSockets. This is the case when using the provided native installers, packages, or the Docker containers, as well as when running Jenkins with the command java -jar jenkins.war.

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability.

 https://cve.radiocsirt.org/vuln/gsd-2024-23898 gsd-2024-23898 2026-10-03T08:24:24.286463+00:00 gsd-2024-23898 https://cve.radiocsirt.org/vuln/rhsa-2024:0775 RHSA-2024:0775 — Red Hat Security Advisory: jenkins and jenkins-2-plugins security update 2026-10-03T08:24:24.286475+00:00

SnakeYaml: Constructor Deserialization Remote Code Execution maven-shared-utils: Command injection via Commandline class apache-commons-text: variable interpolation RCE jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin Jenkins: Temporary file parameter created with insecure permissions Jenkins: Information disclosure through error stack traces related to agents Jenkins: Session fixation vulnerability in OpenShift Login Plugin jenkins: Arbitrary file read vulnerability through the CLI can lead to RCE jenkins: cross-site WebSocket hijacking

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0199 WID-SEC-W-2024-0199 — Jenkins: Mehrere Schwachstellen 2026-10-03T08:24:24.286511+00:00

Ein entfernter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Cross-Site Scripting (XSS)-Angriffe durchzuführen.