CVE-2025-64134

—

CVSS 3.1

7.1 high

EPSS

<1%p26

Published

Oct 29, 2025 (Oct 29, 2025)

Modified

Jun 17, 2026

Description

Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.

Vendors: jenkins
Products: jdepend
Weakness: CWE-611
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.