CVE-2026-70439

The Jenkins XML Job to Job DSL Plugin version 0.1.13 and earlier is vulnerable to a missing permission check. Attackers lacking appropriate permissions can invoke the plugin's conversion functionality. Specifically, while users can only access jobs for which they have Item/Read permission, the pl...

CVE-2026-70439

Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality...

PT-2026-68274

Name of the Vulnerable Software and Affected Versions Jenkins XML Job to Job DSL Plugin versions prior to 0.1.14 Description The plugin fails to perform necessary permission checks, which allows users without the required privileges to trigger the conversion functionality. Recommendations Update...

CVE-2026-70439: Missing Authorization

Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality...

org.biouno:uno-choice (>=2.8.5, <=2.8.6), org.jenkins-ci.plugins:job-dsl (1.90) potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1365.v4778ca_84b_de5)

org.jenkins-ci.plugins:script-security MAVEN version 1365.v4778ca84bde5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.biouno:uno-choice =2.8.5, =2.8.6 - org.jenkins-ci.plugins:job-dsl...

org.biouno:uno-choice (>=2.8.5, <=2.8.6), org.jenkins-ci.plugins:job-dsl (1.90) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1365.v4778ca_84b_de5)

org.jenkins-ci.plugins:script-security MAVEN version 1365.v4778ca84bde5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.biouno:uno-choice =2.8.5, =2.8.6 - org.jenkins-ci.plugins:job-dsl...

org.biouno:uno-choice (>=2.8.5, <=2.8.6), org.jenkins-ci.plugins:job-dsl (1.90) potentially affected by CVE-2026-42519 via org.jenkins-ci.plugins:script-security (1365.v4778ca_84b_de5)

org.jenkins-ci.plugins:script-security MAVEN version 1365.v4778ca84bde5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.biouno:uno-choice =2.8.5, =2.8.6 - org.jenkins-ci.plugins:job-dsl...

CVE-2025-68925

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the code doesn't validate that the JWT header specifies "alg":"RS256". This vulnerability is fixed in 2.2...

CVE-2025-68702

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses padLeft32, '0' when it should use padLeft64, '0' because SHA-256 produces 32 bytes which equates to 64 hex characters. This vulnerability is fixed in 2.2...

CVE-2025-68698

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses PKCS1Encoding which is vulnerable to Bleichenbacher padding oracle attacks. Modern systems should use OAEP Optimal Asymmetric Encryption Padding. This vulnerability is fixed in 2.2...

CVE-2025-68703

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sumpassphrase. Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2...

CVE-2025-68704

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2...

CVE-2025-68701

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses deterministic AES IV derivation from a passphrase. This vulnerability is fixed in 2.2...

CVE-2025-68925

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the code doesn't validate that the JWT header specifies "alg":"RS256". This vulnerability is fixed in 2.2...

CVE-2025-68698

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses PKCS1Encoding which is vulnerable to Bleichenbacher padding oracle attacks. Modern systems should use OAEP Optimal Asymmetric Encryption Padding. This vulnerability is fixed in 2.2...

CVE-2025-68702

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses padLeft32, '0' when it should use padLeft64, '0' because SHA-256 produces 32 bytes which equates to 64 hex characters. This vulnerability is fixed in 2.2...

CVE-2025-68925

Summary (CVE-2025-68925): Jervis (net.gleske:jervis) is vulnerable prior to version 2.2 due to a JWT header check omission that fails to enforce the algorithm field (alg) to RS256. The issue allows potential JWT forgery or signature bypass depending on context, as described in multiple sources (e...

CVE-2025-68701 Jervis has Deterministic AES IV Derivation from Passphrase

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses deterministic AES IV derivation from a passphrase. This vulnerability is fixed in 2.2...

CVE-2025-68698 Jervis has an RSA PKCS#1 v1.5 Padding Vulnerability

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses PKCS1Encoding which is vulnerable to Bleichenbacher padding oracle attacks. Modern systems should use OAEP Optimal Asymmetric Encryption Padding. This vulnerability is fixed in 2.2...

PT-2026-2493

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses PKCS1Encoding which is vulnerable to Bleichenbacher padding oracle attacks. Modern systems should use OAEP Optimal Asymmetric Encryption Padding. This vulnerability is fixed in 2.2...