https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T06:49:45.011279+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-04250 bdu:2026-04250 2026-10-04T06:49:45.189711+00:00 bdu:2026-04250 https://cve.radiocsirt.org/vuln/bit-jenkins-2026-33001 BIT-jenkins-2026-33001 2026-10-04T06:49:45.189753+00:00

Affected: Bitnami: jenkins

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.

 https://cve.radiocsirt.org/vuln/euvd-2026-365481 EUVD-2026-365481 2026-10-04T06:49:45.189787+00:00 EUVD-2026-365481 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33001 fkie_cve-2026-33001 2026-10-04T06:49:45.189801+00:00

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.

 https://cve.radiocsirt.org/vuln/ghsa-r6qv-frpc-q66c GHSA-r6qv-frpc-q66c — Jenkins has a link following vulnerability allows arbitrary file creation 2026-10-04T06:49:45.189823+00:00

Affected: Maven: org.jenkins-ci.main:jenkins-core

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.

 https://cve.radiocsirt.org/vuln/rhsa-2026:10199 RHSA-2026:10199 — Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update. 2026-10-04T06:49:45.189845+00:00

jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression org.jenkins-ci.main/jenkins-core: Jenkins: Stored Cross-site Scripting (XSS) via unescaped user-provided offline cause description org.jenkins-ci.main/jenkins-core: Jenkins: Information disclosure via unauthorized access to build parameters jenkins: Jenkins: Arbitrary file write and potential code execution through crafted archives

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0779 WID-SEC-W-2026-0779 — Jenkins: Mehrere Schwachstellen 2026-10-04T06:49:45.189868+00:00

Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.