https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-11T21:29:22.198016+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cnvd-2021-38298 cnvd-2021-38298 2026-10-11T21:29:22.208527+00:00 cnvd-2021-38298 https://vulnerability.circl.lu/vuln/fkie_cve-2021-21659 fkie_cve-2021-21659 2026-10-11T21:29:22.208603+00:00

Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

 https://vulnerability.circl.lu/vuln/ghsa-34j5-c4cv-mmg5 GHSA-34j5-c4cv-mmg5 — XXE vulnerability in Jenkins URLTrigger Plugin 2026-10-11T21:29:22.208657+00:00

Affected: Maven: org.jenkins-ci.plugins:urltrigger

Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with Job/Configure permission or otherwise able to control the contents of an URL to an XML document being examined for changes to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the polling Jenkins controller or agent, server-side request forgery, or denial-of-service attacks.

UJenkins RLTrigger Plugin 0.49 disables external entity resolution for its XML parser.

 https://vulnerability.circl.lu/vuln/gsd-2021-21659 gsd-2021-21659 2026-10-11T21:29:22.208711+00:00 gsd-2021-21659