CVE-2026-84666

The Jenkins Job Configuration History Plugin (version 1367.vc8fa_b_15101dc and earlier) is vulnerable to improper input validation via Stapler data binding . The plugin's constructor used the @DataBoundConstructor annotation, which allowed the Stapler web framework to invoke @DataBoundSetter meth...

CVE-2026-84666

Jenkins Job Configuration History Plugin 1367.vc8fab15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings...

CVE-2026-84667

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups...

CVE-2026-84667

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups...

EUVD-2026-70133

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups...

CVE-2026-84667

The Jenkins ThinBackup Plugin (version 2.1.4 and earlier ) is vulnerable to an improper limitation of a pathname to a restricted directory. The root cause is the use of the @DataBoundConstructor annotation in the Stapler web framework, which allows attackers to submit forms that overwrite the plu...

EUVD-2026-70132

Jenkins Job Configuration History Plugin 1367.vc8fab15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings...

CVE-2026-84666

Jenkins Job Configuration History Plugin 1367.vc8fab15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings...

EUVD-2026-70130

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

CVE-2026-84664

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

CVE-2026-84664

The Jenkins GitLab Plugin (version 1.9.16 and earlier ) is vulnerable to an improper access control issue due to the use of the Stapler web framework data-binding mechanism. Specifically, the plugin incorrectly uses the @DataBoundConstructor annotation on a constructor, which allows Stapler to in...

CVE-2026-84664

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

CVE-2026-84662

Jenkins LDAP Plugin 807.809.vd3a4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an attacker-specified URL...

EUVD-2026-70128

Jenkins LDAP Plugin 807.809.vd3a4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an attacker-specified URL...

CVE-2026-84662

Jenkins LDAP Plugin 807.809.vd3a4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an attacker-specified URL...

CVE-2026-84662

The Jenkins LDAP Plugin (version 807.809.vd3a_4e5e4ec98 and earlier) is vulnerable to Server-Side Request Forgery (SSRF) due to improper access control in the Stapler web framework data-binding mechanism. The plugin uses the @DataBoundConstructor annotation on a constructor that connects to a spe...

CVE-2026-84659

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...

CVE-2026-84659

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...

CVE-2026-84659

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding...

CVE-2026-84659

The Jenkins Script Security Plugin (version 1412.v7737b_3405f86 and earlier) fails to enforce a permission check in the method governing the "Force the use of the sandbox globally in the system" setting. This allows attackers to disable the global sandbox via Stapler data binding . To remediate t...