CVE-2026-57302

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system...

CVE-2026-57301

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller...

CVE-2026-48142 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, nginx-stable, nginx-mainline, ingress-nginx-controller-fips...

GHSA-78JW-WW3G-9WP7 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, nginx-stable, nginx-mainline, ingress-nginx-controller-fips...

GHSA-2388-JP8V-FG9W vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, nginx-stable, nginx-mainline, ingress-nginx-controller-fips...

CVE-2026-42055 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, nginx-stable, nginx-mainline, ingress-nginx-controller-fips...

CVE-2026-42055 vulnerabilities

Vulnerabilities for packages: nginx-stable, ingress-nginx-controller, nginx-mainline...

CVE-2026-48142 vulnerabilities

Vulnerabilities for packages: nginx-stable, ingress-nginx-controller, nginx-mainline...

GHSA-2388-JP8V-FG9W vulnerabilities

Vulnerabilities for packages: nginx-stable, ingress-nginx-controller, nginx-mainline...

GHSA-78JW-WW3G-9WP7 vulnerabilities

Vulnerabilities for packages: nginx-stable, ingress-nginx-controller, nginx-mainline...

CVE-2026-57302

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system...

CVE-2026-57301

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller...

CVE-2026-57301

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller...

CVE-2026-57302

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system...

EUVD-2026-38782

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller...

CVE-2026-57301

The Jenkins OWASP ZAP Plugin (version 1.0.7 and earlier ) lacks support for distributed builds, causing the "Automatically build ZAP" feature to perform file operations and build processes on the Jenkins controller instead of the assigned agent. An attacker with Item/Configure permission can expl...

CVE-2026-57302

The Jenkins FitNesse Plugin (version 1.36 and earlier ) stores passwords unencrypted within the job config.xml files on the Jenkins controller. This vulnerability allows users with Extended Read permissions or any individual with direct access to the Jenkins controller file system to view these p...

CVE-2026-57296

The Jenkins External Workspace Manager Plugin (version 1.3.2 and earlier) contains a path traversal vulnerability. The plugin fails to reject .. path segments when validating the custom workspace path provided to the exwsAllocate Pipeline step, allowing the path to escape the configured disk moun...

CVE-2026-57296

Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can...

Builds executed on the Jenkins controller by zapper can lead to RCE

zapper 1.0.7 and earlier does not support distributed builds, causing the file operations and build process of its "Automatically build ZAP" feature to be performed on the Jenkins controller rather than on the agent the build is assigned to. This allows attackers with Item/Configure permission to...