https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T22:00:41.414450+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2019-10395 fkie_cve-2019-10395 2026-09-30T22:00:44.525432+00:00

Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.145, 2.138.1, or older, exploitable by users able to change various job/build properties.

 https://vulnerability.circl.lu/vuln/ghsa-88qj-3q6h-8m5q GHSA-88qj-3q6h-8m5q — Jenkins Build Environment Plugin vulnerable to Cross-site Scripting 2026-09-30T22:00:44.525544+00:00

Affected: Maven: org.jenkins-ci.plugins:build-environment

Build Environment Plugin did not escape values of environment variables shown on its views. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the values of build environment variables, typically users with Job/Configure or Job/Build permission.

Jenkins applies the missing escaping by default since 2.146 and LTS 2.138.2, so newer Jenkins releases are not affected by this vulnerability.

Build Environment Plugin now escapes all variables displayed in its views.

 https://vulnerability.circl.lu/vuln/gsd-2019-10395 gsd-2019-10395 2026-09-30T22:00:44.525614+00:00 gsd-2019-10395