CVE-2026-117622

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-117621

Jenkins versions 2.587 and earlier (LTS 2.580.1 and earlier ) are vulnerable to a cross-site scripting (XSS) vulnerability. The root cause is that the agent computes the URL for links displayed in the workspace browser for every file and directory. This flaw allows attackers who have control of a...

EUVD-2026-112186

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-117621

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-117622

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-117622

Jenkins versions 2.587 and earlier (including LTS 2.580.1 and earlier ) are vulnerable to a cross-site scripting (XSS) vulnerability (CVE-2026-117622 ). The root cause allows agents to send exceptions that implement the Stapler HttpResponse interface back to the controller. This can be exploited ...

EUVD-2026-112187

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-117622

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-117621

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-117621

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-117622

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-117621: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-117622: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

PT-2026-128310

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

XSS vulnerability in handling of agent errors

To protect against deserialization vulnerabilities, Jenkins restricts the types of objects that agents can send to the controller https://jenkins.io/jep/200JEP-200. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the...

XSS vulnerability in workspace browser

When the workspace of a job is located on an agent, Jenkins retrieves the list of files and directories shown in the workspace browser from that agent. In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the agent computes the URL of the link shown for each file and directory. This results in ...

PT-2026-128309

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-84648

A flaw was found in Jenkins. The system log viewer does not properly escape log record metadata, such as the source, level, and timestamp. This vulnerability allows attackers who control agent processes to inject malicious scripts. Successful exploitation can lead to a stored cross-site scripting...

CVE-2026-84648

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata source, level, and timestamp resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-84648

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata source, level, and timestamp resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...