BugRater
Early access: the directory is still filling out, and every rating here is a reported experience.

Security releases

Jenkins

Jenkins Security Advisory 2025-10-29

2025-10-29 Oct 29, 2025 Source: Vendor

Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2025-10-29/. 14 SECURITY issues listed. Draft. Review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.jenkins.io/security/advisory/2025-10-29/
Are you credited here? Sign in and claim your line: it is yours immediately, no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

15 lines
All 15 CVEs 15 Additional recognition 0 Unclaimed only
Showing 1–15 of 15
CVE-2025-64141 BR2025-0000-008674 SECURITY-3550 unclaimed
CSRF vulnerability and missing permission checks in Nexus Task Runner Plugin
Credited as Aris ISSAD, Aix Marseille University
CVE-2025-64134 BR2025-0000-008675 SECURITY-2936 unclaimed
XXE vulnerability in JDepend Plugin
Credited as CC Bomber, Kitri BoB
CVE-2025-64149 BR2025-0000-008676 SECURITY-3576 unclaimed
CSRF vulnerability and missing permission check in Publish to Bitbucket Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2025-64131 BR2025-0000-008677 SECURITY-3613 unclaimed
Replay vulnerability in SAML Plugin
Credited as Denys Digtiar, CloudBees, Inc.
CVE-2025-64144 BR2025-0000-008678 SECURITY-3560 unclaimed
API tokens stored in plain text by ByteGuard Build Actions Plugin
Credited as Hamadache Mohamed, Aix Marseille University
CVE-2025-64146 BR2025-0000-008679 SECURITY-3562 unclaimed
API Keys stored in plain text by Curseforge Publisher Plugin
Credited as Hamadache Mohamed, Aix Marseille University
CVE-2025-64132 BR2025-0000-008680 SECURITY-3622 unclaimed
Missing permission checks in MCP Server Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2025-64138 BR2025-0000-008681 SECURITY-3531 unclaimed
CSRF vulnerability and missing permission check in Start Windocks Containers Plugin
Credited as Lotfi Yahi, Aix Marseille University
CVE-2025-64148 BR2025-0000-008682 SECURITY-3570 unclaimed
Missing permission check in Publish to Bitbucket Plugin allows enumerating credentials IDs
Credited as Lotfi Yahi, Aix Marseille University
CVE-2025-64133 BR2025-0000-008683 SECURITY-3583 unclaimed
CSRF vulnerability in Extensible Choice Parameter Plugin
Credited as Lotfi Yahi, Aix Marseille University
CVE-2025-64135 BR2025-0000-008684 SECURITY-3326 unclaimed
Java protection mechanism disabled in Eggplant Runner Plugin
Credited as Pierre Beitz, CloudBees, Inc.
CVE-2025-64143 BR2025-0000-008685 SECURITY-3553 unclaimed
Authorization Token stored in plain text by OpenShift Pipeline Plugin
Credited as Romuald Moisan, Aix Marseille University
CVE-2025-64136 BR2025-0000-008686 SECURITY-3517 unclaimed
CSRF vulnerability and missing permission check in Themis Plugin
Credited as Romuald Moisan, Aix Marseille University
CVE-2025-64136 BR2025-0000-008687 SECURITY-3517 unclaimed
CSRF vulnerability and missing permission check in Themis Plugin
Credited as Vincent Lardet, Aix Marseille University
CVE-2025-64140 BR2025-0000-008688 SECURITY-3538 unclaimed
Shell command injection vulnerability in Azure CLI Plugin
Credited as Said Abdesslem Messadi, Aix Marseille University