com.mig82:folder-properties (61.vc6d404b_75d60), io.jenkins.plugins:opentelemetry (>=3.1487.vf27fcf83deb_b, <=3.1505.v69c4d7c9ee62) +4 more potentially affected by CVE-2026-57283 via io.jenkins.plugins:pipeline-groovy-lib (744.v5b_556ee7c253)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 744.v5b556ee7c253 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - com.mig82:folder-properties 61.vc6d404b75d60 -...

org.jenkins-ci.plugins:pipeline-github-lib (65.v203688e7727e) potentially affected by CVE-2026-57284 via io.jenkins.plugins:pipeline-groovy-lib (745.vdf6077913de0)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 745.vdf6077913de0 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - org.jenkins-ci.plugins:pipeline-github-lib 65.v203688e7727e Source cves...

org.jenkins-ci.plugins:pipeline-github-lib (65.v203688e7727e) potentially affected by CVE-2026-57283 via io.jenkins.plugins:pipeline-groovy-lib (745.vdf6077913de0)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 745.vdf6077913de0 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - org.jenkins-ci.plugins:pipeline-github-lib 65.v203688e7727e Source cves...

io.jenkins.blueocean:blueocean (>=1.27.19, <=1.27.26), io.jenkins.blueocean:blueocean-bitbucket-pipeline (>=1.27.19, <=1.27.26) +19 more potentially affected by CVE-2026-57284 via io.jenkins.plugins:pipeline-groovy-lib (752.vdddedf804e72)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 752.vdddedf804e72 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - io.jenkins.blueocean:blueocean =1.27.19, =1.27.19, =1.27.19, =1.27.19,...

io.jenkins.blueocean:blueocean (>=1.27.19, <=1.27.26), io.jenkins.blueocean:blueocean-bitbucket-pipeline (>=1.27.19, <=1.27.26) +19 more potentially affected by CVE-2026-57283 via io.jenkins.plugins:pipeline-groovy-lib (752.vdddedf804e72)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 752.vdddedf804e72 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - io.jenkins.blueocean:blueocean =1.27.19, =1.27.19, =1.27.19, =1.27.19,...

io.jenkins.plugins:pipeline-lib-oras (46.va_0ee7b_f1b_02a) potentially affected by CVE-2026-57284 via io.jenkins.plugins:pipeline-groovy-lib (776.vfee5327b_b_a_5b)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 776.vfee5327bba5b is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - io.jenkins.plugins:pipeline-lib-oras 46.va0ee7bf1b02a Source cves:...

io.jenkins.plugins:pipeline-lib-oras (46.va_0ee7b_f1b_02a) potentially affected by CVE-2026-57283 via io.jenkins.plugins:pipeline-groovy-lib (776.vfee5327b_b_a_5b)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 776.vfee5327bba5b is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - io.jenkins.plugins:pipeline-lib-oras 46.va0ee7bf1b02a Source cves:...

io.jenkins.plugins:pipeline-lib-oras (>=84.vcfdc020586ef, <=90.vecb_55543088a), org.jenkins-ci.plugins:changelog-history (1.4) +2 more potentially affected by CVE-2026-57284 via io.jenkins.plugins:pipeline-groovy-lib (787.ve2fef0efdca_6)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 787.ve2fef0efdca6 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - io.jenkins.plugins:pipeline-lib-oras =84.vcfdc020586ef,...

io.jenkins.plugins:pipeline-lib-oras (>=84.vcfdc020586ef, <=90.vecb_55543088a), org.jenkins-ci.plugins:changelog-history (1.4) +2 more potentially affected by CVE-2026-57283 via io.jenkins.plugins:pipeline-groovy-lib (787.ve2fef0efdca_6)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 787.ve2fef0efdca6 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - io.jenkins.plugins:pipeline-lib-oras =84.vcfdc020586ef,...

com.fuzzpro.jenkins-plugins:multibranch-job-tear-down (>=61.v68b_d7264b_643, <=69.vc3f564093641), io.jenkins.plugins:pipeline-lib-oras (105.v0413172a_ec91) potentially affected by CVE-2026-57284 via io.jenkins.plugins:pipeline-groovy-lib (798.v5cc688825312)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 798.v5cc688825312 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - com.fuzzpro.jenkins-plugins:multibranch-job-tear-down =61.v68bd7264b643...

com.fuzzpro.jenkins-plugins:multibranch-job-tear-down (>=61.v68b_d7264b_643, <=69.vc3f564093641), io.jenkins.plugins:pipeline-lib-oras (105.v0413172a_ec91) potentially affected by CVE-2026-57283 via io.jenkins.plugins:pipeline-groovy-lib (798.v5cc688825312)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 798.v5cc688825312 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - com.fuzzpro.jenkins-plugins:multibranch-job-tear-down =61.v68bd7264b643...

com.fuzzpro.jenkins-plugins:multibranch-job-tear-down (73.ve2b_957fc2921) potentially affected by CVE-2026-57284 via io.jenkins.plugins:pipeline-groovy-lib (805.va_fc79344957d)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 805.vafc79344957d is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - com.fuzzpro.jenkins-plugins:multibranch-job-tear-down 73.ve2b957fc2921...

com.fuzzpro.jenkins-plugins:multibranch-job-tear-down (73.ve2b_957fc2921) potentially affected by CVE-2026-57283 via io.jenkins.plugins:pipeline-groovy-lib (805.va_fc79344957d)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 805.vafc79344957d is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - com.fuzzpro.jenkins-plugins:multibranch-job-tear-down 73.ve2b957fc2921...

com.amadeus.jenkins.plugins:workflow-cps-global-lib-http (2.33.0) potentially affected by CVE-2026-57284 via io.jenkins.plugins:pipeline-groovy-lib (685.v8ee9ed91d574)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 685.v8ee9ed91d574 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - com.amadeus.jenkins.plugins:workflow-cps-global-lib-http 2.33.0 Source...

Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability

Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, instantiating any type with a constructor annotated with @DataBoundConstructor in response to a request. This allows attackers to have...

GHSA-2W2H-GWWJ-FH3Q Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types

Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, instantiating any type with a constructor annotated with @DataBoundConstructor in response to a request. This allows attackers to have...

com.amadeus.jenkins.plugins:workflow-cps-global-lib-http (>=2.34.0, <=2.57.0) potentially affected by CVE-2026-57284 via io.jenkins.plugins:pipeline-groovy-lib (689.veec561a_dee13)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 689.veec561adee13 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - com.amadeus.jenkins.plugins:workflow-cps-global-lib-http =2.34.0, =2.57...

CVE-2026-57281

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the...

CVE-2026-57283

A cross-site request forgery CSRF vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types related to job or system configuration other than Pipeline steps through the Pipeline Snippet Generator...

CVE-2026-57284

Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to instantiate types related to job or system configuration other than Pipeline steps...