CVE-2026-117625

A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy...

CVE-2026-117616

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary...

CVE-2026-117625

A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy...

CVE-2026-117625

A missing permission check in Jenkins versions 2.587 and earlier , as well as LTS 2.580.1 and earlier , allows attackers who possess Overall/Read permissions to access sensitive configuration details. Specifically, an attacker can obtain the server , port , user name , and no-proxy host list of t...

CVE-2026-117620

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

CVE-2026-117620

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

CVE-2026-117616

Jenkins versions 2.587 and earlier , as well as LTS 2.580.1 and earlier , are vulnerable to a path traversal flaw. The issue stems from an HTTP endpoint that loads agents by name without proper validation. This allows an attacker with Overall/Read permissions to load any config.xml file from the ...

CVE-2026-117616

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary...

CVE-2026-117616

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary...

CVE-2026-117616

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary...

EUVD-2026-112181

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary...

CVE-2026-117623: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Read permission...

CVE-2026-117620: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

PT-2026-128304

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.588 Jenkins LTS versions prior to 2.580.2 Description An HTTP endpoint loads agents by name without proper validation, enabling a path traversal attack. An attacker with Overall/Read permission can load any config.x...

PT-2026-128308

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.587 Jenkins LTS versions prior to 2.580.1 Description Users with Overall/Read permission can trigger warnings within the "Manage Old Data" feature. If an administrator acts upon these crafted warnings, it allows the...

PT-2026-128311

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Read permission...

CVE-2026-117616: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary...

PT-2026-88163

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

CVE-2026-84646

A flaw was found in Jenkins. An attacker with Overall/Read permission can exploit a deserialization vulnerability where user objects can appear as nested field values in other deserialized XML objects. By submitting crafted XML, the attacker can create unauthorized user objects. While these creat...

CVE-2026-84646

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...