https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:30:45.067280+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-jenkins-2026-53437 BIT-jenkins-2026-53437 2026-10-03T04:30:45.256528+00:00

Affected: Bitnami: jenkins

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.

 https://cve.radiocsirt.org/vuln/euvd-2026-365474 EUVD-2026-365474 2026-10-03T04:30:45.256589+00:00 EUVD-2026-365474 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53437 fkie_cve-2026-53437 2026-10-03T04:30:45.256606+00:00

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.

 https://cve.radiocsirt.org/vuln/ghsa-463r-5m89-4xfr GHSA-463r-5m89-4xfr — Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL 2026-10-03T04:30:45.256630+00:00

Affected: Maven: org.jenkins-ci.main:jenkins-core

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.

 https://cve.radiocsirt.org/vuln/rhsa-2026:60239 RHSA-2026:60239 — Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update. 2026-10-03T04:30:45.256653+00:00

jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409) Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass mina: mina: Arbitrary Code Execution via Deserialization Bypass jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration jenkins: Jenkins: Phishing attack via improper red…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1884 WID-SEC-W-2026-1884 — Jenkins: Mehrere Schwachstellen 2026-10-03T04:30:45.256716+00:00

Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Programmcode auszuführen, sich als Benutzer auszugeben, Benutzer auf vom Angreifer kontrollierte Domänen umzuleiten, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen und zu manipulieren sowie Cross-Site-Scripting-Angriffe durchzuführen.