https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T11:05:33.651897+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-307860 EUVD-2026-307860 2026-10-04T11:05:33.654626+00:00 EUVD-2026-307860 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42521 fkie_cve-2026-42521 2026-10-04T11:05:33.654656+00:00

Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.

 https://cve.radiocsirt.org/vuln/ghsa-jp9r-mmhw-vff3 GHSA-jp9r-mmhw-vff3 — Jenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors 2026-10-04T11:05:33.654688+00:00

Affected: Maven: org.jenkins-ci.plugins:matrix-auth

Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated.

This can be abused by attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.

Matrix Authorization Strategy Plugin 3.2.10 verifies that the class being instantiated is an inheritance strategy implementation, preventing instantiation of arbitrary types.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1320 WID-SEC-W-2026-1320 — Jenkins Plugins: Mehrere Schwachstellen 2026-10-04T11:05:33.654716+00:00

Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen sowie Cross-Site-Scripting- oder Phishing-Angriffe durchzuführen.