EUVD-2026-70146

Jenkins Customizable Header Plugin 295.v2544bca19b97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting XSS vulnerability...

CVE-2026-84673

CVE-2026-84673 affects the Jenkins Customizable Header Plugin in versions 295.v2544b_ca_19b_97 and earlier . The root cause is Stapler data binding , which allows an attacker with low privileges to overwrite the plugin's appearance configuration. By setting a custom SVG icon containing inline Jav...

CVE-2026-84673

Jenkins Customizable Header Plugin 295.v2544bca19b97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting XSS vulnerability...