Security advisories

medium2025-10-29

CVE-2025-64148-Jenkins Publish to Bitbucket Plugin is missing a permissions check

jenkinsci/publish-to-bitbucket-plugin · GHSA-v549-7pm5-f8qr

medium2025-10-29

CVE-2025-64149-Jenkins Publish to Bitbucket Plugin vulnerable to CSRF and missing permissions check

jenkinsci/publish-to-bitbucket-plugin · GHSA-m244-6mff-p355

medium2025-10-29

CVE-2025-64147-Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form

jenkinsci/curseforge-publisher-plugin · GHSA-hv42-crpx-q355

medium2025-10-29

CVE-2025-64135-Jenkins Eggplant Runner Plugin protection mechanism disabled

jenkinsci/eggplant-runner-plugin · GHSA-w5r3-gr8w-7fj5

medium2025-10-29

CVE-2025-64145-Jenkins ByteGuard Build Actions Plugin does not mask API tokens displayed on the job configuration form

jenkinsci/byteguard-build-actions-plugin · GHSA-vmm2-53rc-43v3

high2025-10-29

CVE-2025-64140-Jenkins Azure CLI Plugin does not restrict the commands it executes

jenkinsci/azure-cli-plugin · GHSA-rh72-238f-g26q

medium2025-10-29

CVE-2025-64132-Jenkins MCP Server Plugin does not perform permission checks in multiple MCP tools

jenkinsci/mcp-server-plugin · GHSA-mrpq-9jr3-rqq9

medium2025-10-29

CVE-2025-64139-Jenkins Start Windocks Containers Plugin is missing a permission check

jenkinsci/windocks-start-container-plugin · GHSA-mj6v-4wr4-gj57

medium2025-10-29

CVE-2025-64137-Jenkins Themis Plugin is missing a permission check

jenkinsci/themis-plugin · GHSA-jwm4-955w-4hj3

high2025-10-29

CVE-2025-64134-Jenkins JDepend Plugin vulnerable to XML external entity attacks

jenkinsci/jdepend-plugin · GHSA-jfg6-4gx3-3v7w

high2025-10-29

CVE-2025-64131-Jenkins SAML Plugin does not implement a replay cache

jenkinsci/saml-plugin · GHSA-j7r7-7qmf-xq87

medium2025-10-29

CVE-2025-64136-Jenkins Themis Plugin vulnerable to cross-site request forgery

jenkinsci/themis-plugin · GHSA-93mh-mx9w-m69q

medium2025-10-29

CVE-2025-64138-Jenkins Start Windocks Containers Plugin vulnerable to cross-site request forgery

jenkinsci/windocks-start-container-plugin · GHSA-6mgr-3374-4p3c

medium2025-10-29

CVE-2025-64143-Jenkins OpenShift Pipeline Plugin stores authorization tokens unencrypted in job config.xml files

jenkinsci/openshift-pipeline-plugin · GHSA-4653-9q2r-684q

medium2025-10-29

CVE-2025-64133-Jenkins Extensible Choice Parameter Plugin vulnerable to cross-site request forgery

jenkinsci/extensible-choice-parameter-plugin · GHSA-3jw2-5hjg-hc2c

medium2025-10-29

CVE-2025-64144-Jenkins ByteGuard Build Actions Plugin stores API tokens unencrypted in job config.xml files

jenkinsci/byteguard-build-actions-plugin · GHSA-2vmr-8c82-x8xq

medium2025-10-29

CVE-2025-64146-Jenkins Curseforge Publisher Plugin stores API Keys unencrypted in job config.xml files

jenkinsci/curseforge-publisher-plugin · GHSA-23vj-j6jc-w892

medium2025-10-29

CVE-2025-62798-Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax

code16/sharp · GHSA-9f58-4465-23c7

medium2025-10-29

NextAuthjs Email misdelivery Vulnerability

nextauthjs/next-auth · GHSA-5jpx-9hw9-2fx4

medium2025-10-29

CVE-2025-12058-Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery

keras-team/keras · GHSA-mq84-hjqx-cwf2