132 matches found
CVE-2026-70444
The CVE covers a missing permission check in the Jenkins Violation Comments to GitLab Plugin (versions 2.62.0 and earlier). The underlying issue is an HTTP endpoint that does not enforce correct permissions, allowing users with Overall/Read privileges to enumerate credentials IDs stored in Jenkin...
CVE-2026-57299
CVE-2026-57299: Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read to enumerate the names of configured Contrast metadata. Public references (NVD, CVE lists, Alpine, EUVD, Att&CK entries, and the Jenkins security...
CVE-2026-57291
Missing permission checks in Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method...
CVE-2026-53439
Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine other users' configured timezone and to enumerate view names of other users' "My Views"...
CVE-2026-48923
Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL...
CVE-2019-16567
A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...
CVE-2025-64139
CVE-2025-64139 affects Jenkins Start Windocks Containers Plugin versions 1.4 and earlier. A missing permission check on an HTTP endpoint allows an attacker with Overall/Read permission to connect to an attacker-specified URL. Related advisories corroborate that this wormable-like behavior is via ...
EUVD-2022-5121
Malicious code in bioql PyPI...
EUVD-2022-5202
Malicious code in bioql PyPI...
EUVD-2022-1899
Malicious code in bioql PyPI...
EUVD-2022-4612
Malicious code in bioql PyPI...
EUVD-2022-2086
Malicious code in bioql PyPI...
EUVD-2022-2145
Malicious code in bioql PyPI...
EUVD-2022-5477
Malicious code in bioql PyPI...
EUVD-2022-2486
Malicious code in bioql PyPI...
EUVD-2022-3550
Malicious code in bioql PyPI...
EUVD-2022-2208
Malicious code in bioql PyPI...
CVE-2022-20620
Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2021-21651
Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain the list of configured profiles...
CVE-2019-10439
A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...