io.jenkins.plugins:aws-sam (>=1.2.7, <=1.2.13), org.jenkins-ci.plugins:azure-dev-spaces (>=3.0.0, <=3.0.3) +2 more potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (1.16)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.plugins:aws-sam =1.2.7, =3.0.0, =0.2.1, =2.0.13, =2.0.15 Source...

io.jenkins.plugins:aws-sam (>=1.2.7, <=1.2.13), org.jenkins-ci.plugins:azure-dev-spaces (>=3.0.0, <=3.0.3) +2 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (1.16)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.plugins:aws-sam =1.2.7, =3.0.0, =0.2.1, =2.0.13, =2.0.15 Source...

org.jenkins-ci.plugins:appio (>=1.1, <=1.3), org.jenkins-ci.plugins:config-file-provider (>=2.6, <=2.6.2) +1 more potentially affected by CVE-2024-47805 via org.jenkins-ci.plugins:credentials (1.4)

org.jenkins-ci.plugins:credentials MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - org.jenkins-ci.plugins:appio =1.1, =2.6, =1.4, =1.4.9 Source cves: CVE-2024-47805 Source...

io.jenkins.blueocean:blueocean (1.2.0-beta-1), io.jenkins.blueocean:blueocean-events (1.2.0-beta-1) +10 more potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (2.11)

org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 2.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - io.jenkins.blueocean:blueocean 1.2.0-beta-1 -...

org.jenkins-ci.plugins:github-autostatus (>=1.0, <=2.0), org.jenkins-ci.plugins:xcode-plugin (>=2.0.13, <=2.0.15) +2 more potentially affected by CVE-2022-43401 +3 more via org.jenkins-ci.plugins.workflow:workflow-cps (2.36.1)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.36.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins:github-autostatus =1.0, =2.0.13, =1.2-beta-4,...

io.jenkins.blueocean:blueocean (1.2.0-beta-1), io.jenkins.blueocean:blueocean-events (1.2.0-beta-1) +9 more potentially affected by CVE-2022-43403 via org.jenkins-ci.plugins:script-security (1.29)

org.jenkins-ci.plugins:script-security MAVEN version 1.29 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.blueocean:blueocean 1.2.0-beta-1 - io.jenkins.blueocean:blueocean-events...

org.jenkins-ci.plugins:github-autostatus (>=1.0, <=2.0), org.jenkins-ci.plugins:xcode-plugin (>=2.0.13, <=2.0.15) +2 more potentially affected by CVE-2022-43402 via org.jenkins-ci.plugins.workflow:workflow-cps (2.36.1)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.36.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins:github-autostatus =1.0, =2.0.13, =1.2-beta-4,...

org.jenkins-ci.plugins:appio (>=1.1, <=1.3), org.jenkins-ci.plugins:config-file-provider (>=2.6, <=2.6.2) +1 more potentially affected by CVE-2019-10320 via org.jenkins-ci.plugins:credentials (1.4)

org.jenkins-ci.plugins:credentials MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - org.jenkins-ci.plugins:appio =1.1, =2.6, =1.4, =1.4.9 Source cves: CVE-2019-10320 Source...

org.jenkins-ci.plugins:appio (>=1.1, <=1.3), org.jenkins-ci.plugins:config-file-provider (>=2.6, <=2.6.2) +1 more potentially affected by CVE-2018-1000601 via org.jenkins-ci.plugins:credentials (1.4)

org.jenkins-ci.plugins:credentials MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - org.jenkins-ci.plugins:appio =1.1, =2.6, =1.4, =1.4.9 Source cves: CVE-2018-1000601 Source...

org.jenkins-ci.plugins:github-autostatus (>=1.0, <=2.0), org.jenkins-ci.plugins:xcode-plugin (>=2.0.13, <=2.0.15) +2 more potentially affected by CVE-2022-25180 via org.jenkins-ci.plugins.workflow:workflow-cps (2.36.1)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.36.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins:github-autostatus =1.0, =2.0.13, =1.2-beta-4,...

io.jenkins.blueocean:blueocean (>=1.0.0-rc2, <=1.2.0-beta-1), io.jenkins.blueocean:blueocean-dashboard (>=1.0.0-rc2, <=1.0.0) +8 more potentially affected by CVE-2022-25183 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.7)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-rc2,...

org.jenkins-ci.plugins:appio (>=1.1, <=1.3), org.jenkins-ci.plugins:config-file-provider (>=2.6, <=2.6.2) +1 more potentially affected by CVE-2021-21648 via org.jenkins-ci.plugins:credentials (1.4)

org.jenkins-ci.plugins:credentials MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - org.jenkins-ci.plugins:appio =1.1, =2.6, =1.4, =1.4.9 Source cves: CVE-2021-21648 Source...

XXE vulnerability in xcode-plugin

xcode-plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control the input files for the Xcode build step to have Jenkins parse a crafted Xcode Workspace File that uses external entities for extraction of secrets...