Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to improper context being set during credentials lookup. An attacker can access credentials they are not authorized to use by leveraging Item/Configure permissions to trigger Jenkins to send these credentials t...

CVE-2026-70443

Jenkins Horreum Plugin 0.16.162.v33b4aab5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL...

CVE-2026-70443

Jenkins Horreum Plugin 0.16.162.v33b4aab5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL...

EUVD-2026-53537

Jenkins Horreum Plugin 0.16.162.v33b4aab5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL...

CVE-2026-70443

The Jenkins Horreum Plugin version 0.16.162.v33b_4a_a_b_5f828 and earlier is vulnerable to a credentials exposure issue. The plugin fails to set the correct context during credentials lookup, which allows users with Item/Configure permissions to trigger Jenkins to send System-scoped credentials t...

CVE-2026-70443

Jenkins Horreum Plugin 0.16.162.v33b4aab5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL...

CVE-2026-70443

Jenkins Horreum Plugin 0.16.162.v33b4aab5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL...

CVE-2026-70443

Jenkins Horreum Plugin 0.16.162.v33b4aab5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL...

Jenkins plugins Multiple Vulnerabilities (2026-08-05)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2... CVE-2026-70426 - Jenkins 2.575 and...

CVE-2026-70443: Improper Privilege Management

Jenkins Horreum Plugin 0.16.162.v33b4aab5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL...

PT-2026-68278

Name of the Vulnerable Software and Affected Versions Jenkins Horreum Plugin versions 0.16.162.v33b 4a a b 5f828 and earlier Description An issue exists where the plugin fails to set the appropriate context for credentials lookup. This allows users with Item/Configure permissions to trick Jenkins...

Exposure of System-scoped credentials in horreum

horreum 0.16.162.v33b4aab5f828 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to have Jenkins send credentials they are not...

io.debezium:debezium-server (2.0.0.alpha1), io.debezium:debezium-server-core (2.0.0.alpha1) +112 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.8.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.8.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.debezium:debezium-server 2.0.0.alpha1 - io.debezium:debezium-server-core 2.0.0.alpha1 -...

com.jalalkiswani:j-app-service (>=7.0.0-pre-release, <=7.0.2), com.jalalkiswani:j-app-web (>=7.0.0-pre-release, <=7.0.2) +41 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (22.0.3)

org.keycloak:keycloak-adapter-core MAVEN version 22.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.jalalkiswani:j-app-service =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release,...

io.jenkins.plugins:horreum (>=0.1.552.v3c9793d4e515, <=0.16.162.v33b_4a_a_b_5f828), org.jenkins-ci.main:jenkins-core (>=2.440, <=2.458) +5 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:remoting (3206.vb_15dcf73f6a_9)

org.jenkins-ci.main:remoting MAVEN version 3206.vb15dcf73f6a9 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:remoting and may be impacted: - io.jenkins.plugins:horreum =0.1.552.v3c9793d4e515, =2.440, =2.440, =3.44,...

io.jenkins.plugins:horreum (>=0.1.552.v3c9793d4e515, <=0.16.162.v33b_4a_a_b_5f828), org.jenkins-ci.main:jenkins-core (>=2.440, <=2.458) +5 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:remoting (3206.vb_15dcf73f6a_9)

org.jenkins-ci.main:remoting MAVEN version 3206.vb15dcf73f6a9 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:remoting and may be impacted: - io.jenkins.plugins:horreum =0.1.552.v3c9793d4e515, =2.440, =2.440, =3.44,...

io.jenkins.plugins:horreum (>=0.1.552.v3c9793d4e515, <=0.16.162.v33b_4a_a_b_5f828), org.jenkins-ci.main:jenkins-war (>=2.439, <=2.441) potentially affected by CVE-2024-23898 via org.jenkins-ci.main:jenkins-core (>=2.439, <=2.441)

org.jenkins-ci.main:jenkins-core MAVEN version =2.439, =0.1.552.v3c9793d4e515, =2.439, =2.441 Source cves: CVE-2024-23898 Source advisory: OSV:GHSA-53PH-2R2X-VQW8...

io.jenkins.plugins:horreum (>=0.1.552.v3c9793d4e515, <=0.16.162.v33b_4a_a_b_5f828), org.jenkins-ci.main:jenkins-war (>=2.439, <=2.441) potentially affected by CVE-2024-23898 via org.jenkins-ci.main:jenkins-core (>=2.439, <=2.441)

org.jenkins-ci.main:jenkins-core MAVEN version =2.439, =0.1.552.v3c9793d4e515, =2.439, =2.441 Source cves: CVE-2024-23898 Source advisory: MEND:CVE-2024-23898...

io.hyperfoil.tools:horreum-client (>=0.1, <=0.2), io.thorntail.servers:microprofile (>=2.6.0.final, <=2.7.0.final) +5 more potentially affected by CVE-2020-25633 via org.jboss.resteasy:resteasy-client-microprofile (>=3.6.0.cr1, <=3.13.2.final)

org.jboss.resteasy:resteasy-client-microprofile MAVEN version =3.6.0.cr1, =0.1, =2.6.0.final, =2.6.0.final, =2.6.0.final, =2.6.0.final, =2.6.0.final, =3.6.0.cr1, =3.13.2.final Source cves: CVE-2020-25633 Source advisory: GHSA-HR32-MGPM-QF2F...