Most recent entries from all

EUVD-2026-322113

2026-10-08T21:30:40.975879+00:00

EUVD-2026-322113

fkie_cve-2026-48920

2026-10-08T21:30:40.975916+00:00

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.

GHSA-mq58-m26g-46gp — Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arb…

2026-10-08T21:30:40.975949+00:00

Affected: Maven: org.jenkins-ci.plugins:email-ext

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier includes a feature that allows inlining images as `base64` in email content by setting the `data-inline` attribute. No restrictions are placed on the image URLs that can be inlined.

This allows attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.

The feature allowing inlining images as `base64` in email content by setting the `data-inline` attribute is removed from Email Extension Plugin 1933.1935.v276319e3cc47.

WID-SEC-W-2026-1707 — Jenkins Plugins: Mehrere Schwachstellen

2026-10-08T21:30:40.975979+00:00

Ein Angreifer kann mehrere Schwachstellen in Jenkins Plugins ausnutzen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um beliebigen Programmcode auszuführen, und um Sicherheitsvorkehrungen zu umgehen.