https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T01:43:42.344351+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-329840 EUVD-2026-329840 2026-10-05T01:43:42.347198+00:00 EUVD-2026-329840 https://cve.radiocsirt.org/vuln/fkie_cve-2026-57289 fkie_cve-2026-57289 2026-10-05T01:43:42.347248+00:00

Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to capture the token.

 https://cve.radiocsirt.org/vuln/ghsa-jwhr-h7pc-3974 GHSA-jwhr-h7pc-3974 — Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation 2026-10-05T01:43:42.347281+00:00

Affected: Maven: io.jenkins.plugins:bitbucket-push-and-pull-request

Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for the connections it makes to Bitbucket Server using Bearer token authentication.

Because the Bearer token is transmitted in these requests, this allows attackers able to intercept network traffic to capture the token and impersonate the Jenkins controller to Bitbucket Server.

Bitbucket Push and Pull Request Plugin 3.3.9 validates SSL/TLS certificates and hostnames for the connections it makes to Bitbucket Server using Bearer token authentication, using the trust store configured for the Jenkins controller JVM.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2074 WID-SEC-W-2026-2074 — Jenkins Plugins: Mehrere Schwachstellen 2026-10-05T01:43:42.347310+00:00

Ein Angreifer kann mehrere Schwachstellen in Jenkins Plugins ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen zu manipulieren oder offenzulegen.