https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 23:22:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-322113 EUVD-2026-322113 https://cve.radiocsirt.org/vuln/euvd-2026-322113 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48920 <p>Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.</p> <p>Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48920 https://cve.radiocsirt.org/vuln/ghsa-mq58-m26g-46gp <p><strong>Affected:</strong> Maven: org.jenkins-ci.plugins:email-ext</p> <p>Jenkins Email Extension Plugin 1933.v45cec755423f and earlier includes a feature that allows inlining images as `base64` in email content by setting the `data-inline` attribute. No restrictions are placed on the image URLs that can be inlined.</p> <p>This allows attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.</p> <p>The feature allowing inlining images as `base64` in email content by setting the `data-inline` attribute is removed from Email Extension Plugin 1933.1935.v276319e3cc47.</p> <p><strong>Affected:</strong> Maven: org.jenkins-ci.plugins:email-ext</p> <p>Jenkins Email Extension Plugin 1933.v45cec755423f and earlier includes a feature that allows inlining images as `base64` in email content by setting the `data-inline` attribute. No restrictions are placed on the image URLs that can be inlined.</p> <p>This allows attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.</p> <p>The feature allowing inlining images as `base64` in email content by setting the `data-inline` attribute is removed from Email Extension Plugin 1933.1935.v276319e3cc47.</p> https://cve.radiocsirt.org/vuln/ghsa-mq58-m26g-46gp https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1707 <p>Ein Angreifer kann mehrere Schwachstellen in Jenkins Plugins ausnutzen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um beliebigen Programmcode auszuführen, und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Jenkins Plugins ausnutzen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um beliebigen Programmcode auszuführen, und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1707