CVE-2026-77692

CVE-2026-77692 allows an unauthenticated remote attacker to crash the BIND 9 named daemon by sending a single crafted DNS-over-HTTPS (DoH) request containing a cryptographically invalid SIG(0) record and then closing the transport connection prematurely . The resulting abort produces an availabil...

CVE-2026-92140

The Jenkins Gitee Plugin (versions 1301.v8957053c7902 and earlier) fails to escape the sender name from Gitee push webhook payloads when rendering build causes. This results in a stored cross-site scripting (XSS) vulnerability exploitable by any attacker able to trigger builds via the plugin's we...

CVE-2026-92141

The Jenkins Keycloak Authentication Plugin versions 2.4.1 and earlier do not restrict the redirect URL after login. An attacker can craft a Jenkins URL that, after a successful authentication, forwards the user to an arbitrary external site, enabling phishing attacks . The vulnerability is classi...

CVE-2026-92139

The Jenkins Bitbucket Push and Pull Request Plugin (versions 4.0.1 and earlier) is affected by a Server-Side Request Forgery (SSRF) vulnerability in its webhook endpoint (/bitbucket-hook/). The plugin trusts URL values supplied in the webhook payload and uses its configured Bitbucket credentials ...

CVE-2026-92138

CVE-2026-92138 affects the Jenkins Bitbucket Server Integration Plugin (atlassian-bitbucket-server-integration) versions 6.0.1 and earlier . The OAuth authorization endpoint reads the oauth_callback URL from the submitted form instead of the server-side stored request token , allowing an attacker...

CVE-2026-92137

Jenkins Robot Framework Plugin (robot) versions 6.2.2 and earlier suffer from a path traversal flaw: the archive directory configured for Robot Framework report files is not validated to be contained within the build directory on the Jenkins controller. An attacker with Item/Configure permission ...

CVE-2026-92136

Jenkins OWASP Dependency-Check Plugin (dependency-check-jenkins-plugin) 5.6.4 and earlier does not escape CWE values from Dependency-Check reports when rendered in the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability. Attackers with Item/Configure permission can inject m...

CVE-2026-92135

Jenkins Coverage Plugin versions 3.3358.v9487dde48783 and earlier do not validate the coverage results ID when a job configuration is submitted through the REST API. Attackers with Item/Configure permission can use a javascript: scheme URL as the identifier, resulting in a stored cross-site scrip...

CVE-2026-92134

Jenkins Warnings Plugin (warnings-ng) version 13.10258.va_17d49a_78c3b_ and earlier fails to validate the analysis results ID when a job configuration is submitted through the REST API. An attacker with Item/Configure permission can inject a javascript: scheme URL as the identifier, resulting in ...

CVE-2026-92133

Jenkins GitLab Plugin version 1.2149.vcfc32c82b_f7f and earlier is affected by a cache confusion vulnerability. When a job overrides the globally configured GitLab API token with an alternative credential, the plugin caches the resulting API client using a key derived from the credentials ID alon...

CVE-2026-92132

Jenkins Gradle Plugin versions 2.19.1252.v15196b_5a_6e10 and earlier are vulnerable to an SSRF attack. When a Develocity server URL is configured in the global configuration, the plugin's enriched build scan summary should request data from that configured URL. Instead, it requests data from the ...

CVE-2026-92130

Jenkins Pipeline: Multibranch Plugin (workflow-multibranch) versions 841.vec5b_9e1806ec and earlier do not set the appropriate context for credentials lookup in the resolveScm Pipeline step. This allows attackers with Item/Configure permission to access and capture System-scoped credentials that ...

CVE-2026-92131

Jenkins Pipeline: Groovy Libraries Plugin (version 805.va_fc79344957d and earlier) contains a path traversal vulnerability in the library Pipeline step. The plugin does not restrict the library path to a relative path inside the SCM checkout and follows symbolic links to locations outside the che...

CVE-2026-92129

CVE-2026-92129 affects the Jenkins Script Security Plugin version 1415.v9a_f9b_3a_c253d and earlier . The plugin's sandbox does not intercept calls from sandboxed scripts to methods dynamically added to a class at runtime via Groovy's class extension feature. An attacker with permission to define...

CVE-2026-92127

Jenkins Script Security Plugin versions 1415.v9a_f9b_3a_c253d and earlier automatically approve classpath entries in an item configuration when a user with Overall/Administer permission copies the item or updates its configuration through the REST API or CLI . This allows attackers who can define...

CVE-2026-92128

CVE-2026-92128 affects the Jenkins Script Security Plugin (versions 1415.v9a_f9b_3a_c253d and earlier). The root cause is a TOCTOU race condition : when a sandboxed script is evaluated, the plugin downloads a URL-specified JAR file twice —confirming approval of the first download but loading clas...

CVE-2026-92125

The Jenkins Script Security Plugin (versions 1415.v9a_f9b_3a_c253d and earlier ) fails to reject the @GroovyASTTransformationClass annotation. A sandboxed script can use this annotation to link to an arbitrary AST transformation, causing Groovy to execute that transformation at compile time—befor...

CVE-2026-92126

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable...

CVE-2026-92124

Jenkins Script Security Plugin versions 1415.v9a_f9b_3a_c253d and earlier contain a sandbox bypass vulnerability. When a sandboxed script casts a Groovy collection to another type, the plugin checks operations on the collection's elements but performs the cast on the collection itself. An attacke...

CVE-2026-92122

The Jenkins Script Security Plugin (≤ 1415.v9a_f9b_3a_c253d ) contains a sandbox bypass vulnerability. When a sandboxed Groovy script coerces a value to an interface, Groovy creates a proxy that forwards interface method calls to a method of the same name on that value. The plugin fails to check ...