https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 01:18:09 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-322123 EUVD-2026-322123 https://cve.radiocsirt.org/vuln/euvd-2026-322123 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48919 <p>Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.</p> <p>Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48919 https://cve.radiocsirt.org/vuln/ghsa-p2gw-f3rv-82mw <p><strong>Affected:</strong> Maven: org.jenkins-ci.plugins:active-directory</p> <p>Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals from the configured Active Directory server by default. These can forward to an RMI URL that causes Jenkins to deserialize attacker-controlled data, resulting in Remote Code Execution (RCE) on the Jenkins controller if deserialization &#34;gadgets&#34; are available on the classpath.</p> <p>This allows attackers able to control the configured Active Directory server, or able to perform a machine-in-the-middle attack, to execute code on the Jenkins controller.</p> <p>Active Directory Plugin 2.41.1 no longer follows LDAP referrals by default.</p> <p>Administrators unable to update to a fixed version can start Jenkins with the Java system property `hudson.plugins.active_directory.referral.ignore` set to `true` to mitigate the vulnerability.</p> <p>Administrators of Jenkins controllers requiring following LDAP referrals can set the Java system property `hudson.plugins.active_directory.referral.ignore` to `false` to restore the previous behavior.</p> <p><strong>Affected:</strong> Maven: org.jenkins-ci.plugins:active-directory</p> <p>Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals from the configured Active Directory server by default. These can forward to an RMI URL that causes Jenkins to deserialize attacker-controlled data, resulting in Remote Code Execution (RCE) on the Jenkins controller if deserialization &#34;gadgets&#34; are available on the classpath.</p> <p>This allows attackers able to control the configured Active Directory server, or able to perform a machine-in-the-middle attack, to execute code on the Jenkins controller.</p> <p>Active Directory Plugin 2.41.1 no longer follows LDAP referrals by default.</p> <p>Administrators unable to update to a fixed version can start Jenkins with the Java system property `hudson.plugins.active_directory.referral.ignore` set to `true` to mitigate the vulnerability.</p> <p>Administrators of Jenkins controllers requiring following LDAP referrals can set the Java system property `hudson.plugins.active_directory.referral.ignore` to `false` to restore the previous behavior.</p> https://cve.radiocsirt.org/vuln/ghsa-p2gw-f3rv-82mw https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1707 <p>Ein Angreifer kann mehrere Schwachstellen in Jenkins Plugins ausnutzen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um beliebigen Programmcode auszuführen, und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Jenkins Plugins ausnutzen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um beliebigen Programmcode auszuführen, und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1707