UNKNOWN NVD

CVE-2026-117613

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST con

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted `config.xml` files that can lead to, e.g., stored cross-site scripting (XSS) vulnerabilities.

References

https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4225

Published: 2026-10-28 · Source: NVD · Feed updated: 2026-10-28

This unknown severity vulnerability was published on 2026-10-28 via NVD.

vulnfeed aggregates 14990 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.