PT-2026-51793

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Groovy Plugin versions prior to 4331.v9d06ed4658ff Description A cross-site request forgery CSRF issue exists in the Pipeline Snippet Generator. This flaw allows attackers to instantiate types related to system configuration ...

PT-2026-51791

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1402.v94c9ce464861 Description The plugin fails to reject Groovy AST Abstract Syntax Tree transformation annotations that contain an extensions member. This allows attackers with the ability to...

Jenkins plugins Multiple Vulnerabilities (2026-06-24)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing...

Exploit for Eval Injection in Xwiki

CVE-2025-24893 - XWiki Unauthenticated RCE Exploit POC ⚠️ U...

org.jenkins-ci.main:jenkins-test-harness (1.581), org.jenkins-ci.main:jenkins-war (1.581) +5 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.581)

org.jenkins-ci.main:jenkins-core MAVEN version 1.581 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.581 - org.jenkins-ci.main:jenkins-war 1.581 -...

org.jenkins-ci.main:jenkins-test-harness (1.581), org.jenkins-ci.main:jenkins-war (1.581) +5 more potentially affected by CVE-2026-53440 via org.jenkins-ci.main:jenkins-core (1.581)

org.jenkins-ci.main:jenkins-core MAVEN version 1.581 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.581 - org.jenkins-ci.main:jenkins-war 1.581 -...

org.jenkins-ci.main:jenkins-test-harness (1.581), org.jenkins-ci.main:jenkins-war (1.581) +5 more potentially affected by CVE-2026-53439 via org.jenkins-ci.main:jenkins-core (1.581)

org.jenkins-ci.main:jenkins-core MAVEN version 1.581 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.581 - org.jenkins-ci.main:jenkins-war 1.581 -...

org.jenkins-ci.main:jenkins-test-harness (1.581), org.jenkins-ci.main:jenkins-war (1.581) +5 more potentially affected by CVE-2026-53435 via org.jenkins-ci.main:jenkins-core (1.581)

org.jenkins-ci.main:jenkins-core MAVEN version 1.581 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.581 - org.jenkins-ci.main:jenkins-war 1.581 -...

org.jenkins-ci.main:jenkins-test-harness (1.581), org.jenkins-ci.main:jenkins-war (1.581) +5 more potentially affected by CVE-2026-53442 via org.jenkins-ci.main:jenkins-core (1.581)

org.jenkins-ci.main:jenkins-core MAVEN version 1.581 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.581 - org.jenkins-ci.main:jenkins-war 1.581 -...

CVE-2026-48921

A flaw was found in the Jenkins Pipeline: Groovy Libraries Plugin. This vulnerability allows an attacker, who can control the content of a library used by a Pipeline job, to read arbitrary files from the Jenkins controller filesystem. This could lead to the disclosure of sensitive information...

CVE-2026-39816

The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy...

groovy (>=0.0.5, <=0.0.16) potentially affected by CVE-2026-10783 via gradio (5.19.0)

gradio PYPI version 5.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - groovy =0.0.5, =0.0.16 Source cves: CVE-2026-10783 Source advisory: OSV:GHSA-6655-8PH2-63J3...

groovy (>=0.0.5, <=0.0.16) potentially affected by CVE-2026-10783 via gradio (5.19.0)

gradio PYPI version 5.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - groovy =0.0.5, =0.0.16 Source cves: CVE-2026-10783 Source advisory: OSV:PYSEC-2026-211...

Exploit for Code Injection in Xwiki

CVE-2025-24893 Exploit de Execução Remota de Código RCE no X...

CVE-2026-42782

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code reaching a non-sandboxed execution path via the class static initializer. This issue affects...

groovy (>=0.0.5, <=0.0.16) potentially affected by CVE-2026-48545 via gradio (5.19.0)

gradio PYPI version 5.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - groovy =0.0.5, =0.0.16 Source cves: CVE-2026-48545 Source advisory: OSV:GHSA-7HP7-4P35-3CX2...

com.amadeus.jenkins.plugins:workflow-cps-global-lib-http (2.33.0) potentially affected by CVE-2026-48921 via io.jenkins.plugins:pipeline-groovy-lib (685.v8ee9ed91d574)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 685.v8ee9ed91d574 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - com.amadeus.jenkins.plugins:workflow-cps-global-lib-http 2.33.0 Source...

com.mig82:folder-properties (57.vde5161ec7a_b_a), io.jenkins.blueocean:blueocean (>=1.27.17, <=1.27.18) +13 more potentially affected by CVE-2026-48921 via io.jenkins.plugins:pipeline-groovy-lib (704.vc58b_8890a_384)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 704.vc58b8890a384 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - com.mig82:folder-properties 57.vde5161ec7aba -...

io.jenkins.plugins:shared-library-version-override (>=17.v786074c9fce7, <=24.v102d8d8fd0cc) potentially affected by CVE-2026-48921 via io.jenkins.plugins:pipeline-groovy-lib (730.ve57b_34648c63)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 730.ve57b34648c63 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - io.jenkins.plugins:shared-library-version-override =17.v786074c9fce7,...

com.mig82:folder-properties (61.vc6d404b_75d60), io.jenkins.plugins:opentelemetry (>=3.1487.vf27fcf83deb_b, <=3.1505.v69c4d7c9ee62) +4 more potentially affected by CVE-2026-48921 via io.jenkins.plugins:pipeline-groovy-lib (744.v5b_556ee7c253)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 744.v5b556ee7c253 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - com.mig82:folder-properties 61.vc6d404b75d60 -...