PT-2026-68275

Name of the Vulnerable Software and Affected Versions Jenkins Qualys Container Scanning Connector Plugin versions prior to 1.8.0.6 Description Stored cross-site scripting XSS occurs because user-controlled field values are not properly escaped within a JavaScript context. This issue can be...

CVE-2026-70440: Improper Neutralization of Input During Web Page Generation

Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2023-4777: Incorrect Permission Assignment for Critical Resource

An incorrect permission check in Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier allows attackers with global Item/Configure permission while lacking Item/Configure permission on any particular job to enumerate credentials IDs of credentials stored in Jenkins and to connect to an...