Developer Tools

In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier a medium severity vulnerability CVE-2026-53438 was detected. This vulnerability allows an attacker to cancel queue items they do not have permission to view. This occurs due to a missing permission check: users possessing the Item/Cancel permission, but lacking the Item/Read permission, are not properly restricted during the queue item cancellation process. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53438.

In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier a medium severity vulnerability CVE-2026-53440 was detected. This vulnerability allows an attacker to perform phishing attacks by redirecting users to a malicious, attacker-controlled domain (Open Redirect). This occurs because the “Delegate to servlet container” security realm fails to properly validate the from parameter to ensure it is safe to redirect to after a successful login. To address this issue, users should upgrade Jenkins to a patched version 2.568 or LTS 2.555.3 (or later). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53440.

In GitLab CE/EE versions 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 a medium severity vulnerability CVE-2026-10733 was detected. This vulnerability allows an authenticated user to cause a Denial of Service (DoS) condition. This occurs due to improper sanitization of user input on the CI/CD Catalog page. To address this issue, users should upgrade GitLab CE/EE to versions 18.10.8, 18.11.5, or 19.0.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-10733.

In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier a medium severity vulnerability CVE-2026-53442 was detected. This vulnerability allows an attacker with Item/Extended Read permission, or access to the Jenkins controller file system, to access sensitive information. This occurs because Jenkins fails to encrypt secrets submitted via the POST config.xml API before storing them. As a result, these secrets are saved in plaintext within the job’s config.xml files on the Jenkins controller. To address this issue, users should upgrade Jenkins to a patched version 2.568.0 or later, or LTS 2.555.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53442.

In GitLab EE versions 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 a high severity vulnerability CVE-2026-10087 was detected. This vulnerability allows an authenticated user with developer-role permissions to execute arbitrary client-side code on behalf of a targeted user, effectively leading to a Cross-Site Scripting (XSS) attack. This occurs due to improper input sanitization within the Analytics Dashboard. To address this issue, users should upgrade GitLab EE to versions 18.10.8, 18.11.5, or 19.0.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-10087.

In GitLab CE/EE versions 12.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 a low severity vulnerability CVE-2026-3553 was detected. This vulnerability allows an authenticated user to access confidential issue details under certain conditions, leading to sensitive information disclosure. This occurs due to incorrect authorization checks within the application’s issue tracking system. To address this issue, users should upgrade GitLab CE/EE to versions 18.10.8, 18.11.5, or 19.0.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3553.

In Jenkins versions 2.483 through 2.567 (inclusive), and LTS 2.492.1 through 2.555.2 (inclusive) a high severity vulnerability CVE-2026-53441 was detected. This vulnerability allows an authenticated attacker with Agent/Configure permission to execute malicious JavaScript in the context of another user’s browser, leading to a Stored Cross-Site Scripting (XSS) attack. This occurs because Jenkins fails to properly escape the user-provided description of a generic offline cause when set through the POST config.xml API. If a malicious description is provided, the injected payload will be executed when an administrator or another user views the affected node. To address this issue, users should upgrade Jenkins to a patched version to 2.568. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53441.

In Plane versions prior to 1.3.1 a high severity vulnerability CVE-2026-46558 was detected. This vulnerability allows any authenticated attacker to bypass authorization controls, leading to unauthorized data access and modification. This occurs due to a cross-workspace asset authorization bypass flaw, which enables users to read, copy, delete, and overwrite assets belonging to other Plane workspaces. To address this issue, users should upgrade Plane to version 1.3.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-46558.

In OneDev versions up to 15.0.5 a medium severity vulnerability CVE-2026-11440 was detected. This vulnerability allows a remote attacker to bypass intended access controls. This occurs due to improper authorization validation when manipulating the project.defaultBranch argument within the REST API endpoint /repositories/{projectId}/default-branch. To address this issue, users should upgrade OneDev to version 15.0.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11440.