Security advisories

medium2026-05-27

CVE-2026-48925-Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability

kostyasha/github-integration-plugin · GHSA-rf8w-7c3g-7h3g

medium2026-05-27

CVE-2026-48924-Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login

jenkinsci/bitbucket-oauth-plugin · GHSA-r8fj-rff6-f7h5

medium2026-05-27

CVE-2026-48926-Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint

jenkinsci/job-import-plugin · GHSA-p8jh-4p5p-2rfp

medium2026-05-27

CVE-2026-48923-Jenkins AppSpider Plugin does not perform a permission check in a method implementing form validation

rapid7/jenkinsci-appspider-plugin · GHSA-9wm7-8qf3-9v98

medium2026-05-27

CVE-2026-48917-Jenkins LDAP Plugin deserializes data from LDAP referrals without validation

jenkinsci/ldap-plugin · GHSA-x9v8-p946-5pwc

medium2026-05-27

CVE-2026-48918-Jenkins Active Directory Plugin follows LDAP referrals by default

jenkinsci/active-directory-plugin · GHSA-wrhr-54p6-q97f

high2026-05-27

CVE-2026-48921-Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries

jenkinsci/pipeline-groovy-lib-plugin · GHSA-qjq3-wqj5-g37q

medium2026-05-27

CVE-2026-48919-Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation

jenkinsci/active-directory-plugin · GHSA-p2gw-f3rv-82mw

high2026-05-27

CVE-2026-48920-Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem

jenkinsci/email-ext-plugin · GHSA-mq58-m26g-46gp

high2026-05-27

CVE-2026-48922-Jenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentials

jenkinsci/credentials-binding-plugin · GHSA-fxxf-w25w-mcx2

medium2026-05-27

CVE-2026-48916-Jenkins LDAP Plugin follows LDAP referrals

jenkinsci/ldap-plugin · GHSA-fmjp-mw89-c6h6

high2026-05-27

CVE-2026-48545-Gradio contains a cookie injection vulnerability

gradio-app/gradio · GHSA-7hp7-4p35-3cx2

high2026-05-27

CVE-2026-48544-Taipy contains a path traversal vulnerability

avaiga/taipy · GHSA-28gh-q3gw-pvx8

medium2026-05-27

CVE-2026-9704-Keycloak Vulnerable to Improper Validation of Specified Quantity in Input

keycloak/keycloak · GHSA-rr5q-3xwr-f323

high2026-05-27

CVE-2026-36045-picoclaw is vulnerable to OS command injection via the ExecTool component

sipeed/picoclaw · GHSA-cv2p-68f4-f4pw

medium2026-05-27

CVE-2026-9689-Keycloak Services has Improper Validation of Consistency within Input

keycloak/keycloak · GHSA-wcvj-vpvw-9rr5

high2026-05-27

CVE-2026-49014-GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow

osgeo/gdal · GHSA-wphc-7cm7-8mf7

high2026-05-27

CVE-2026-49017-OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body

openstack/swift · GHSA-g7jq-j257-rww2

medium2026-05-27

CVE-2026-44979-@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects

hapijs/wreck · GHSA-vhjm-w67q-g75c

high2026-05-27

CVE-2026-44974-@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters

hapijs/content · GHSA-36hh-x5p5-jgc8