Lucene search
+L

237573 matches found

EUVD
EUVD
added 2026/09/02 3:40 p.m.3 views

EUVD-2026-70148

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build...

7.4CVSS6.1AI score
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/02 3:40 p.m.21 views

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

SaveExploits0References1
CVE
CVE
added 2026/09/02 3:40 p.m.11 views

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin (version 26.1.0 and earlier) allow an attacker with Overall/Read permission to enumerate the IDs of credentials stored in Jenkins. The CVSS v3.1 base score is 5.4 (Medium) , reflecting a network-vector attack with low complexity and ...

5.4CVSS5.9AI score
SaveExploits0References1
EUVD
EUVD
added 2026/09/02 3:40 p.m.5 views

EUVD-2026-70147

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

5.4CVSS5.9AI score
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/02 3:40 p.m.24 views

CVE-2026-84673

Jenkins Customizable Header Plugin 295.v2544bca19b97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting XSS vulnerability...

SaveExploits0References1
CVE
CVE
added 2026/09/02 3:40 p.m.14 views

CVE-2026-84672

The Jenkins Microsoft Entra ID (previously Azure AD) Plugin, versions 710.v0b_ff8e9cc2d2 and earlier , grants Entra group permissions based on both the group's unique object ID and its display name . An attacker who can create an Entra group with a colliding display name can thereby inherit the p...

8.8CVSS5.9AI score
SaveExploits0References1
CVE
CVE
added 2026/09/02 3:40 p.m.13 views

CVE-2026-84671

CVE-2026-84671 affects the Jenkins File Parameter Plugin in versions 425.v3fa_801681b_5e and earlier . The vulnerability stems from Stapler data binding , which allows an attacker with low privileges to write files to arbitrary locations on the Jenkins controller file system , potentially leading...

8.8CVSS6.2AI score
SaveExploits0References1
EUVD
EUVD
added 2026/09/02 3:40 p.m.3 views

EUVD-2026-70145

Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...

8.8CVSS5.9AI score
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/02 3:40 p.m.4 views

CVE-2026-84672

Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...

5.9AI score
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/02 3:40 p.m.4 views

CVE-2026-84671

Jenkins File Parameter Plugin 425.v3fa801681b5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution...

6.2AI score
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/02 3:40 p.m.21 views

CVE-2026-84672

Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...

SaveExploits0References1
Cvelist
Cvelist
added 2026/09/02 3:40 p.m.21 views

CVE-2026-84670

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...

SaveExploits0References1
EUVD
EUVD
added 2026/09/02 3:40 p.m.5 views

EUVD-2026-70140

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...

8.8CVSS6.2AI score
SaveExploits0References1
CVE
CVE
added 2026/09/02 3:40 p.m.16 views

CVE-2026-84670

Jenkins Performance Plugin versions 1015.v09ca_52b_3370e and earlier fail to restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller. An attacker with Item/Configure permission can leverage this to execute...

8.8CVSS6.2AI score
SaveExploits0References1
EUVD
EUVD
added 2026/09/02 3:40 p.m.5 views

EUVD-2026-70134

Jenkins SAML Plugin 4.618.v441a27fa46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user...

8.8CVSS5.9AI score
SaveExploits0References1
EUVD
EUVD
added 2026/09/02 3:40 p.m.6 views

EUVD-2026-70137

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system...

8.8CVSS5.9AI score
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/02 3:40 p.m.5 views

CVE-2026-84668

Jenkins SAML Plugin 4.618.v441a27fa46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user...

5.9AI score
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/02 3:40 p.m.6 views

CVE-2026-84669

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system...

5.9AI score
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/02 3:40 p.m.22 views

CVE-2026-84668

Jenkins SAML Plugin 4.618.v441a27fa46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user...

SaveExploits0References1
CVE
CVE
added 2026/09/02 3:40 p.m.16 views

CVE-2026-84668

Jenkins SAML Plugin (versions 4.618.v441a_27fa_46d2 and earlier) is vulnerable to improper access control via Stapler data binding. The plugin's @DataBoundConstructor-annotated constructor writes the SAML identity provider metadata file to the Jenkins controller file system without checking for t...

8.8CVSS5.9AI score
SaveExploits0References1
Rows per page
Query Builder