https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T12:00:14.241658+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2019-22654 cnvd-2019-22654 2026-10-16T12:00:14.245552+00:00 cnvd-2019-22654 https://cve.radiocsirt.org/vuln/euvd-2026-53591 EUVD-2026-53591 2026-10-16T12:00:14.245589+00:00 EUVD-2026-53591 https://cve.radiocsirt.org/vuln/fkie_cve-2019-10338 fkie_cve-2019-10338 2026-10-16T12:00:14.245602+00:00

A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed attackers to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials.

 https://cve.radiocsirt.org/vuln/ghsa-qww5-p626-rfpf GHSA-qww5-p626-rfpf — Jenkins JX Resources Plugin cross-site request forgery vulnerability 2026-10-16T12:00:14.245631+00:00

Affected: Maven: org.jenkins-ci.plugins:jx-resources

Jenkins jx-resources Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified Kubernetes server and obtain information about an attacker-specified namespace. Doing so might also leak service account credentials used for the connection. Additionally, it allowed attackers to obtain the value of any attacker-specified environment variable for the Jenkins controller process.

Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.

This form validation method now requires POST requests and Overall/Administer permissions.

 https://cve.radiocsirt.org/vuln/gsd-2019-10338 gsd-2019-10338 2026-10-16T12:00:14.245659+00:00 gsd-2019-10338