Jenkins Script Security Plugin

Mentions · 7d0
Mentions · 30d0
All mentions1
First seenSep 17, 2026
Last mentionedSep 17, 2026

Timeline

1 articles · newest first

Jenkins Patches 20 Plugin Flaws Leading to RCE, XSS and Credential Theft

Jenkins patched 20 vulnerabilities across 13 plugins, including Groovy sandbox bypasses enabling remote code execution on CI/CD controllers.

GBHackersSep 17, 06:21 UTC · Sep 17, 2026VulnerabilityCVE-2026-92122 CVE-2026-92123 CVE-2026-92124+172 · 1 read

Related CVEs

by mentions

CVE-2026-92122<1%8.8
Sandbox Bypass in Jenkins Script Security Plugin Allows Controller RCE
published Sep 16, 2026Jenkins project Jenkins Script Security PluginPoC
CVE-2026-921248.8
Sandbox Bypass in Jenkins Script Security Plugin Enables Controller RCE
published Sep 16, 2026Jenkins Script Security Plugin
CVE-2026-921258.8
Groovy sandbox bypass in Jenkins Script Security Plugin enables controller RCE
published Sep 16, 2026Jenkins / jenkinsci Script Security Plugin
CVE-2026-921268.5
Sandbox Escape via @Builder Annotation in Jenkins Script Security Plugin
published Sep 16, 2026Jenkins Script Security Plugin
CVE-2026-921358.0
Stored XSS in Jenkins Coverage Plugin via javascript: Coverage Results ID
published Sep 16, 2026Jenkins Coverage Plugin (Code Coverage API)
CVE-2026-921348.0
Stored XSS in Jenkins Warnings Plugin via javascript: analysis results ID
published Sep 16, 2026Jenkins Warnings Plugin
CVE-2026-921278.0
Sandbox Bypass RCE via Auto-Approved Classpath Entries in Jenkins Script Security Plugin
published Sep 16, 2026Jenkins Script Security Plugin
CVE-2026-921406.8
Stored XSS in Jenkins Gitee Plugin via webhook sender name
published Sep 16, 2026Jenkins / jenkinsci Gitee Plugin
CVE-2026-921396.5
SSRF Credential Capture in Jenkins Bitbucket Push and Pull Request Plugin
published Sep 16, 2026Jenkins Bitbucket Push and Pull Request Plugin
CVE-2026-921414.3
Open Redirect in Jenkins Keycloak Authentication Plugin 2.4.1 and Earlier
published Sep 16, 2026Jenkins Keycloak Authentication Plugin

Appears with

Jenkinsvendor · 1
Jenkinsorganization · 1

Entities are extracted by the model from each article. First seen Sep 17, 2026, last mentioned Sep 17, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.