EUVD-2026-112178

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted config.xml files that can lead to, e.g., stored cross-site scripting XSS vulnerabilities...

CVE-2026-117613

Jenkins versions 2.587 and earlier , and LTS 2.580.1 and earlier , are vulnerable to a flaw where the system fails to restrict item types in collections following deserialization . An attacker with access to POST config.xml API endpoints can submit a crafted config.xml file, potentially leading t...

CVE-2026-117613: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted config.xml files that can lead to, e.g., stored cross-site scripting XSS vulnerabilities...

PT-2026-128301

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted config.xml files that can lead to, e.g., stored cross-site scripting XSS vulnerabilities...