https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-23T08:07:58.269259+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/bit-jenkins-2026-84652 BIT-jenkins-2026-84652 2026-10-23T08:07:58.380819+00:00

Affected: Bitnami: jenkins

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacker access to Jenkins as that user.

 https://db.gcve.eu/vuln/fkie_cve-2026-84652 fkie_cve-2026-84652 2026-10-23T08:07:58.380995+00:00

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacker access to Jenkins as that user.

 https://db.gcve.eu/vuln/ghsa-42rh-v5qm-8p5w GHSA-42rh-v5qm-8p5w 2026-10-23T08:07:58.381063+00:00

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacker access to Jenkins as that user.

 https://db.gcve.eu/vuln/rhsa-2026:88149 RHSA-2026:88149 — Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update. 2026-10-23T08:07:58.381099+00:00

spring-security: authorization bypass for case sensitive comparisons jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections bouncycastle: Bouncy Castle: Denial of Service via untrusted keystore length allocation org.eclipse.jetty.http2/http2-common: org.eclipse.jetty.http2/jetty-http2-common: Jetty: Denial of Service via HTTP/2 race condition org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcprov-jdk18on: org.bouncycastle/bc-fips: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service due to unbounded memory allocation org.eclipse.jetty/jetty-server: org.eclipse.jetty/jetty-proxy: Eclipse Jetty: Access control bypass via case-sensitive host filtering org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests Spring Framework: org.springframework/spring-expression: Spring Framework: Denial of Service via unbounded exponentiation in SpEL expressions Spring Framework: Spring Framework: Memory leak via malformed RSocket SETUP frame org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcprov-jdk15on: Bouncy Castle for Java: Certificate val…