CVE-2026-84645

In Jenkins versions weekly ≤ 2.579 and LTS ≤ 2.568.2 , a deserialization vulnerability (SECURITY-3972) allows for remote code execution (RCE) . The root cause lies in the XStream stack (hudson.util.XStream2 / RobustReflectionConverter), where PersistenceRoot types can be deserialized as nested fi...

PT-2026-84768

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.580 Jenkins LTS versions prior to 2.568.3 Description Objects that store their configuration in independent top-level configuration files, such as jobs and global configuration, can be smuggled as nested field value...

CVE-2026-67319

axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...