https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 08:42:11 +0000 https://db.gcve.eu/vuln/bit-jenkins-2026-70428 <p><strong>Affected:</strong> Bitnami: jenkins</p> <p>Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.</p> <p><strong>Affected:</strong> Bitnami: jenkins</p> <p>Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.</p> https://db.gcve.eu/vuln/bit-jenkins-2026-70428 https://db.gcve.eu/vuln/fkie_cve-2026-70428 <p>Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.</p> <p>Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.</p> https://db.gcve.eu/vuln/fkie_cve-2026-70428 https://db.gcve.eu/vuln/ghsa-c232-r242-w9v9 <p>Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.</p> <p>Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.</p> https://db.gcve.eu/vuln/ghsa-c232-r242-w9v9 https://db.gcve.eu/vuln/rhsa-2026:60239 <p>jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409) Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass mina: mina: Arbitrary Code Execution via Deserialization Bypass jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration jenkins: Jenkins: Phishing attack via improper red…</p> <p>jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409) Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass mina: mina: Arbitrary Code Execution via Deserialization Bypass jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration jenkins: Jenkins: Phishing attack via improper red…</p> https://db.gcve.eu/vuln/rhsa-2026:60239 https://db.gcve.eu/vuln/wid-sec-w-2026-2665 <p>Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren sowie Cross-Site-Scripting- (XSS) oder Server-Side-Request-Forgery- (SSRF) Angriffe durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren sowie Cross-Site-Scripting- (XSS) oder Server-Side-Request-Forgery- (SSRF) Angriffe durchzuführen.</p> https://db.gcve.eu/vuln/wid-sec-w-2026-2665