CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

1158 matches found

NVD•added 2026/01/13 8:16 p.m.•29 views

CVE-2025-68701

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses deterministic AES IV derivation from a passphrase. This vulnerability is fixed in 2.2...

8.7CVSS0.0021EPSS

SaveExploits0References2

NVD•added 2026/01/13 8:16 p.m.•15 views

CVE-2025-68931

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, AES/CBC/PKCS5Padding lacks authentication, making it vulnerable to padding oracle attacks and ciphertext manipulation. This vulnerability is fixed in 2.2...

8.7CVSS0.00179EPSS

SaveExploits0References2

CVE•added 2026/01/13 7:26 p.m.•27 views

CVE-2025-68702

The CVE affects net.gleske:jervis (Jervis) prior to version 2.2. In SecurityIO.groovy, padLeft(32, '0') is used for SHA-256 hex strings, but SHA-256 produces 32 bytes = 64 hex characters; this causes inconsistent hash lengths and potential issues in hash comparisons. The issue is fixed in Jervis ...

8.7CVSS6.4AI score0.00152EPSS

SaveExploits0References2Affected Software1

Cvelist•added 2026/01/13 7:26 p.m.•35 views

CVE-2025-68702 Jervis has a SHA-256 Hex String Padding Bug

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses padLeft32, '0' when it should use padLeft64, '0' because SHA-256 produces 32 bytes which equates to 64 hex characters. This vulnerability is fixed in 2.2...

8.7CVSS0.00152EPSS

SaveExploits0References2

Cvelist•added 2026/01/13 7:21 p.m.•34 views

CVE-2025-68701 Jervis has Deterministic AES IV Derivation from Passphrase

8.7CVSS0.0021EPSS

SaveExploits0References2

Vulnrichment•added 2026/01/13 7:16 p.m.•9 views

CVE-2025-68698 Jervis has an RSA PKCS#1 v1.5 Padding Vulnerability

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses PKCS1Encoding which is vulnerable to Bleichenbacher padding oracle attacks. Modern systems should use OAEP Optimal Asymmetric Encryption Padding. This vulnerability is fixed in 2.2...

8.7CVSS6.5AI score0.00133EPSS

SaveExploits0References2

Positive Technologies•added 2026/01/13 12:00 a.m.•24 views

PT-2026-2494

CVE-2025-68701 Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses deterministic AES IV derivation from a passphrase. Thi… https://t.co/yRJFluABgT...

8.7CVSS6.9AI score0.0021EPSS

SaveExploits0References4

Positive Technologies•added 2026/01/13 12:00 a.m.•20 views

PT-2026-2557

8.7CVSS6.8AI score0.00179EPSS

SaveExploits0References4

Positive Technologies•added 2026/01/13 12:00 a.m.•17 views

PT-2026-2497

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2...

8.2CVSS6.8AI score0.0024EPSS

SaveExploits0References4

Positive Technologies•added 2026/01/13 12:00 a.m.•27 views

PT-2026-2493

8.7CVSS6.9AI score0.00133EPSS

SaveExploits0References4

Positive Technologies•added 2026/01/13 12:00 a.m.•26 views

PT-2026-2556

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the code doesn't validate that the JWT header specifies "alg":"RS256". This vulnerability is fixed in 2.2...

6.9CVSS7.1AI score0.00133EPSS

SaveExploits0References4