https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:13:31 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-08450 bdu:2026-08450 https://cve.radiocsirt.org/vuln/bdu:2026-08450 https://cve.radiocsirt.org/vuln/bit-jenkins-2026-53435 <p><strong>Affected:</strong> Bitnami: jenkins</p> <p>In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.</p> <p><strong>Affected:</strong> Bitnami: jenkins</p> <p>In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.</p> https://cve.radiocsirt.org/vuln/bit-jenkins-2026-53435 https://cve.radiocsirt.org/vuln/euvd-2026-365505 EUVD-2026-365505 https://cve.radiocsirt.org/vuln/euvd-2026-365505 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53435 <p>In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.</p> <p>In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53435 https://cve.radiocsirt.org/vuln/ghsa-g2xq-2v27-4rh3 <p><strong>Affected:</strong> Maven: org.jenkins-ci.main:jenkins-core</p> <p>In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards.</p> <p>This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.</p> <p><strong>Affected:</strong> Maven: org.jenkins-ci.main:jenkins-core</p> <p>In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards.</p> <p>This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.</p> https://cve.radiocsirt.org/vuln/ghsa-g2xq-2v27-4rh3 https://cve.radiocsirt.org/vuln/rhsa-2026:60239 <p>jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409) Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass mina: mina: Arbitrary Code Execution via Deserialization Bypass jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration jenkins: Jenkins: Phishing attack via improper red…</p> <p>jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409) Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass mina: mina: Arbitrary Code Execution via Deserialization Bypass jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration jenkins: Jenkins: Phishing attack via improper red…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:60239 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1884 <p>Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Programmcode auszuführen, sich als Benutzer auszugeben, Benutzer auf vom Angreifer kontrollierte Domänen umzuleiten, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen und zu manipulieren sowie Cross-Site-Scripting-Angriffe durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Programmcode auszuführen, sich als Benutzer auszugeben, Benutzer auf vom Angreifer kontrollierte Domänen umzuleiten, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen und zu manipulieren sowie Cross-Site-Scripting-Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1884