CVE Notifier

CVE-2026-92133 CWE-? N/A

CVE-2026-92133

Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in whic…

cve.org Jenkins · Project:Jenkins · GitLab 16 Sep 2026

CVE-2026-92132 CWE-? N/A

CVE-2026-92132

Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowi…

cve.org Jenkins · Project:Jenkins · Gradle 16 Sep 2026

CVE-2026-92131 CWE-? N/A

CVE-2026-92131

Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to …

cve.org Jenkins · Project:Jenkins · Pipeline: 16 Sep 2026

CVE-2026-92130 CWE-? N/A

CVE-2026-92130

Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access…

cve.org Jenkins · Project:Jenkins · Pipeline: 16 Sep 2026

CVE-2026-92129 CWE-? N/A

CVE-2026-92129

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandbo…

cve.org Jenkins · Project:Jenkins · Script 16 Sep 2026

CVE-2026-92128 CWE-? N/A

CVE-2026-92128

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing atta…

cve.org Jenkins · Project:Jenkins · Script 16 Sep 2026

CVE-2026-92127 CWE-? N/A

CVE-2026-92127

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that confi…

cve.org Jenkins · Project:Jenkins · Script 16 Sep 2026

CVE-2026-92126 CWE-? N/A

CVE-2026-92126

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed …

cve.org Jenkins · Project:Jenkins · Script 16 Sep 2026

CVE-2026-92125 CWE-? N/A

CVE-2026-92125

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, …

cve.org Jenkins · Project:Jenkins · Script 16 Sep 2026

CVE-2026-92124 CWE-? N/A

CVE-2026-92124

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast …

cve.org Jenkins · Project:Jenkins · Script 16 Sep 2026

CVE-2026-92123 CWE-? N/A

CVE-2026-92123

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribute accesses, and array accesses), allowing attackers with per…

cve.org Jenkins · Project:Jenkins · Script 16 Sep 2026

CVE-2026-92122 CWE-? N/A

CVE-2026-92122

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the s…

cve.org Jenkins · Project:Jenkins · Script 16 Sep 2026