Loading story…
A critical command injection flaw tracked as CVE-2024-43028 was disclosed for Jeecg Boot versions 3.0.0 through 3.5.3, affecting the /jmreport/show component. The vulnerability is classified as CWE-77 and can let unauthenticated remote attackers execute arbitrary code through a crafted HTTP request. Its CVSS v3.1 vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicates full compromise potential across confidentiality, integrity, and availability.
A separate high-severity issue, CVE-2026-42524, was reported in the Jenkins HTML Publisher Plugin version 427 and earlier. The bug is a stored XSS vulnerability (CWE-79) caused by improper escaping of job names and URLs in the plugin’s legacy wrapper file, and it can be exploited by attackers with Item/Configure permission. The flaw carries a CVSS v3.1 vector of AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, and Jenkins has published a related security advisory for affected users.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE-2026-42524 record was assigned CWE-79 and a CVSS v3.1 vector of AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. A related Jenkins security advisory was also published.
A stored cross-site scripting flaw affecting Jenkins HTML Publisher Plugin version 427 and earlier was received as CVE-2026-42524. The issue stems from improper escaping of the job name and URL in the plugin's legacy wrapper file and is exploitable by users with Item/Configure permission.
The CVE-2024-43028 entry was updated to add a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and classify the issue as CWE-77 command injection. The update also listed external references hosted on GitHub Gist and Baidu Pan.
A command injection vulnerability affecting Jeecg Boot versions 3.0.0 through 3.5.3 was received by MITRE. The flaw in the /jmreport/show component can allow arbitrary code execution via a crafted HTTP request.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Jenkins published a security advisory covering multiple vulnerabilities in widely used plugins, with fixes released for affected versions. The disclosed issues span **missing permission checks**, **unsafe deserialization**, **stored cross-site scripting**, and an **open redirect**, affecting plugins including **Script Security**, **Credentials Binding**, **Matrix Authorization Strategy**, **GitHub Branch Source**, **GitHub**, **HTML Publisher**, and **Microsoft Entra ID**. The most serious issue is an **arbitrary file write** flaw that can lead to **remote code execution**, while other bugs could let attackers abuse low-privilege access such as `Overall/Read`, `Item/Configure`, or the ability to supply credentials to a job. Jenkins said the advisory includes severity ratings, attribution, and patched plugin versions, and urged administrators to update impacted plugins to the fixed releases.
Jun 29, 2026
Jenkins disclosed two Jenkins Core vulnerabilities affecting **Jenkins 2.550 and earlier** and **LTS 2.541.1 and earlier**: a **high-severity stored XSS** issue (**CVE-2026-27099 / SECURITY-3669**) and a **medium-severity information disclosure** issue via Run Parameter handling (**CVE-2026-27100 / SECURITY-3658**). The XSS flaw stems from improper escaping of user-supplied HTML in the node “offline cause” description (specifically the “Mark temporarily offline” reason), enabling attackers with `Agent/Configure` or `Agent/Disconnect` permissions to inject JavaScript that can execute in other users’ sessions. Jenkins fixed both issues in **Jenkins 2.551** and **LTS 2.541.2** by escaping the offline-cause description and rejecting Run Parameter values that reference builds the submitting user cannot access. For CVE-2026-27099, Jenkins noted that on **Jenkins 2.539+**, enforcing **Content Security Policy (CSP)** can mitigate the impact (with partial protection referenced for newer versions). Both vulnerabilities were reported via the **Jenkins Bug Bounty Program** sponsored by the European Commission, and organizations running affected versions should prioritize upgrading to the patched releases to reduce risk to CI/CD build environments.
Jun 29, 2026
Jenkins, a widely used open-source automation server, has released critical security updates to address multiple high-severity vulnerabilities that could expose CI/CD pipelines to significant risks. The most severe flaw, tracked as CVE-2025-67635, affects Jenkins versions 2.540 and earlier (including LTS 2.528.2 and earlier) and allows unauthenticated attackers to trigger denial-of-service (DoS) attacks via the HTTP-based command-line interface. This vulnerability arises from improper connection handling, where corrupted HTTP CLI streams are not properly closed, enabling attackers to exhaust server resources and render Jenkins instances unresponsive. Organizations relying on Jenkins are urged to upgrade to version 2.541 or LTS 2.528.3 to mitigate this risk. In addition to the DoS vulnerability, another high-severity issue, CVE-2025-67641, was identified in the Jenkins Coverage Plugin. This flaw allows attackers with "Item/Configure" permissions to exploit coverage reports for stored cross-site scripting (XSS) attacks by submitting malicious JavaScript via the REST API. If an administrator views a compromised report, the script executes, potentially leading to session hijacking. Both vulnerabilities have been addressed in the latest Jenkins security updates, and immediate patching is recommended to protect against exploitation.
Jun 29, 2026