Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
4.3 MEDIUM
CVE-2026-70447 — Jenkins AWS CodeBuild Plugin Improper Authorization

Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Remote | Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
4.3 MEDIUM
CVE-2026-70446 — Jenkins CodeSonar Plugin Information Disclosure Vulnerability

Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Remote | Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70445 — Jenkins Sauce OnDemand Plugin Improper Authorization Vulnerability

Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

| Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
4.3 MEDIUM
CVE-2026-70444 — Jenkins Violation Comments to GitLab Plugin Credential ID Enumeration Vulnerability

A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkin…

Remote | Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
4.3 MEDIUM
CVE-2026-70443 — Jenkins Horreum Plugin Credential Disclosure Vulnerability

Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send crede…

Remote | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
4.3 MEDIUM
CVE-2026-70442 — Jenkins Google Chat Notification Plugin Credential Exposure Vulnerability

Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and cap…

Remote | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
5.4 MEDIUM
CVE-2026-70441 — Jenkins Summary Display Plugin Stored Cross-Site Scripting

Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable …

Remote | Cross-Site Scripting
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
5.4 MEDIUM
CVE-2026-70440 — Jenkins Qualys Container Scanning Connector Plugin Stored Cross-Site Scripting

Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting (XSS) vulnerabi…

Remote | Cross-Site Scripting
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
6.5 MEDIUM
CVE-2026-70439 — Jenkins XML Job to Job DSL Plugin Unauthorized Access Vulnerability

Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality.

Remote | Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70438 — Jenkins Parameterized Remote Trigger Plugin Credential Enumeration Vulnerability

A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

| Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70437 — Jenkins Webhook Secret Credentials Provider Plugin Timing Attack Vulnerability

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token …

| Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70436 — Jenkins External Workspace Manager Plugin Improper Authorization Vulnerability

Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper permission check (1.4.1) when providing access to externall…

| Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70435 — Jenkins SCM-Manager Plugin Credential Disclosure Vulnerability

A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials …

| Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70434 — Jenkins SCM-Manager Plugin Cross-Site Request Forgery Vulnerability

A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs ob…

| Cross-Site Request Forgery
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70433 — Jenkins HCL AppScan Plugin Improper Authorization Vulnerability

Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

| Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.8 HIGH
CVE-2026-70432 — Jenkins Multijob Plugin Cross-Site Request Forgery Vulnerability

A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM.

Remote | Cross-Site Request Forgery
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.8 HIGH
CVE-2026-70431 — Jenkins Multijob Plugin Arbitrary Code Execution Vulnerability

Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure per…

Remote | Misconfiguration
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70430 — Jenkins Arbitrary Object Instantiation Vulnerability

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overal…

| Misconfiguration
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
0.0 NA
CVE-2026-70429 — Jenkins User Impersonation via Case-Insensitivity Vulnerability

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-…

| Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
4.3 MEDIUM
CVE-2026-70428 — Jenkins Path Traversal Vulnerability

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission…

Remote | Path Traversal
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
Showing 20 of 9816 Results