https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T15:31:29.439442+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-33755 cnvd-2020-33755 2026-10-17T15:31:29.443089+00:00 cnvd-2020-33755 https://cve.radiocsirt.org/vuln/euvd-2026-35842 EUVD-2026-35842 2026-10-17T15:31:29.443129+00:00 EUVD-2026-35842 https://cve.radiocsirt.org/vuln/fkie_cve-2020-2187 fkie_cve-2020-2187 2026-10-17T15:31:29.443149+00:00

Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enabling man-in-the-middle attacks.

 https://cve.radiocsirt.org/vuln/ghsa-c89c-pvm7-33wj GHSA-c89c-pvm7-33wj — Lack of SSL/TLS certificate and hostname validation in Amazon EC2 Plugin 2026-10-17T15:31:29.443184+00:00

Affected: Maven: org.jenkins-ci.plugins:ec2

Amazon EC2 Plugin connects to Windows agents via HTTPS.

Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed HTTPS certificates and does not perform hostname validation when connecting to Windows agents. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents.

Amazon EC2 Plugin 1.50.2 by default no longer accepts self-signed HTTPS certificates and performs hostname validation. A new configuration option allows restoring the previous, unsafe behavior. For more information see [the plugin documentation](https://github.com/jenkinsci/ec2-plugin/#securing-the-connection-to-windows-amis).

 https://cve.radiocsirt.org/vuln/gsd-2020-2187 gsd-2020-2187 2026-10-17T15:31:29.443223+00:00 gsd-2020-2187