CVE-2026-84671

Jenkins File Parameter Plugin 425.v3fa801681b5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution...

EUVD-2026-70143

Jenkins File Parameter Plugin 425.v3fa801681b5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution...

EUVD-2026-70134

Jenkins SAML Plugin 4.618.v441a27fa46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user...

CVE-2026-84668

Jenkins SAML Plugin 4.618.v441a27fa46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user...

CVE-2026-84668

Jenkins SAML Plugin 4.618.v441a27fa46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user...

CVE-2026-84668

Jenkins SAML Plugin (versions 4.618.v441a_27fa_46d2 and earlier) is vulnerable to improper access control via Stapler data binding. The plugin's @DataBoundConstructor-annotated constructor writes the SAML identity provider metadata file to the Jenkins controller file system without checking for t...

CVE-2026-84666

Jenkins Job Configuration History Plugin 1367.vc8fab15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings...

CVE-2026-84667

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups...

CVE-2026-84666

Jenkins Job Configuration History Plugin versions 1367.vc8fa_b_15101dc and earlier are vulnerable to improper access control via Stapler data binding . The plugin incorrectly uses the @DataBoundConstructor annotation on a constructor for its global configuration, which is not intended to be invok...

CVE-2026-84667

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups...

EUVD-2026-70133

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups...

CVE-2026-84667

CVE-2026-84667 affects Jenkins ThinBackup Plugin 2.1.4 and earlier . The root cause is the use of the @DataBoundConstructor annotation, which allows Stapler to invoke @DataBoundSetter methods managing the plugin's backup configuration. This enables an authenticated attacker to redirect backup wri...

EUVD-2026-70132

Jenkins Job Configuration History Plugin 1367.vc8fab15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings...

EUVD-2026-70130

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

CVE-2026-84664

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

CVE-2026-84664

CVE-2026-84664 affects the Jenkins GitLab Plugin version 1.9.16 and earlier. The root cause is an improper use of Stapler's @DataBoundConstructor annotation on the constructor for the global GitLab connection configuration, which allows Stapler to invoke @DataBoundSetter-annotated methods and ove...

EUVD-2026-70128

Jenkins LDAP Plugin 807.809.vd3a4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an attacker-specified URL...

CVE-2026-84662

Jenkins LDAP Plugin 807.809.vd3a4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an attacker-specified URL...

CVE-2026-84662

Jenkins LDAP Plugin (ldap) versions 807.809.vd3a_4e5e4ec98 and earlier suffer from an improper access control flaw that enables Server-Side Request Forgery (SSRF) . The plugin's use of Stapler's @DataBoundConstructor annotation on a constructor that connects to a specified URL allows attackers ca...

CVE-2026-84659

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...