https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T18:36:54.988162+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-08450 bdu:2026-08450 2026-10-02T18:36:55.082431+00:00 bdu:2026-08450 https://cve.radiocsirt.org/vuln/bit-jenkins-2026-53435 BIT-jenkins-2026-53435 2026-10-02T18:36:55.082472+00:00

Affected: Bitnami: jenkins

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

 https://cve.radiocsirt.org/vuln/euvd-2026-365505 EUVD-2026-365505 2026-10-02T18:36:55.082507+00:00 EUVD-2026-365505 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53435 fkie_cve-2026-53435 2026-10-02T18:36:55.082521+00:00

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

 https://cve.radiocsirt.org/vuln/ghsa-g2xq-2v27-4rh3 GHSA-g2xq-2v27-4rh3 — Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impers… 2026-10-02T18:36:55.082543+00:00

Affected: Maven: org.jenkins-ci.main:jenkins-core

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards.

This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

 https://cve.radiocsirt.org/vuln/rhsa-2026:60239 RHSA-2026:60239 — Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update. 2026-10-02T18:36:55.082569+00:00

jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409) Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass mina: mina: Arbitrary Code Execution via Deserialization Bypass jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration jenkins: Jenkins: Phishing attack via improper red…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1884 WID-SEC-W-2026-1884 — Jenkins: Mehrere Schwachstellen 2026-10-02T18:36:55.082630+00:00

Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Programmcode auszuführen, sich als Benutzer auszugeben, Benutzer auf vom Angreifer kontrollierte Domänen umzuleiten, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen und zu manipulieren sowie Cross-Site-Scripting-Angriffe durchzuführen.