Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-64084 State: PUBLISHED Published: 2025-11-14T00:00:00.000Z Last Updated: 2025-11-16T21:03:47.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated SQL injection vulnerability exists in Cloudlog 2.7.5 and earlier. The vucc_details_ajax function in application/controllers/Awards.php does not properly sanitize the user-supplied Gridsquare POST parameter. This allows a remote, authenticated attacker to execute arbitrary SQL commands by injecting a malicious payload, which is then concatenated directly into a raw SQL query in the vucc_qso_details function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/magicbug/Cloud
qso_details function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/magicbug/Cloudlog/commit/72a8c3d705c8629f60f64da9f37968417c980242 - https://github.com/magicbug/Cloudlog/releases/tag/2.7.6 - https://github.com/XY20130630/Cloudlog/security/advisories/GHSA-4r9r-3r3q-jg44
CVE ID: CVE-2025-64094 State: PUBLISHED Published: 2025-10-28T21:44:31.408Z Last Updated: 2025-10-29T14:52:01.123Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-79 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, sanitization of the content of uploaded SVG files was not covering all possible XSS scenarios. This vulnerability exists because of an incomplete fix for CVE-2025-48378. This vulnerability is fixed in 10.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/D
ty is fixed in 10.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-hmvq-8p83-cq52
CVE ID: CVE-2025-64095 State: PUBLISHED Published: 2025-10-28T21:46:11.267Z Last Updated: 2025-10-29T14:51:08.317Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-434 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads. This vulnerability is fixed in 10.1.1. Additional
acing a website and combined with other issue, injection XSS payloads. This vulnerability is fixed in 10.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-3m8r-w7xg-jqvw
CVE ID: CVE-2025-64096 State: PUBLISHED Published: 2025-10-30T17:09:24.240Z Last Updated: 2025-10-30T18:16:02.552Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: nasa Products: CryptoLib Problem Types: CWE-121 Description: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prier to 1.4.2, there is a missing bounds check in Crypto_Key_update() (crypto_key_mgmt.c) which allows a remote attacker to trigger a stack-based buffer overflow by supplying a TLV packet with a spoofed length fi
ich allows a remote attacker to trigger a stack-based buffer overflow by supplying a TLV packet with a spoofed length field. The function calculates the number of keys from an attacker-controlled field (pdu_len), which may exceed the static array size (kblk[98]), leading to an out-of-bounds write and potential memory corruption. This vulnerability is fixed in 1.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nasa/CryptoLib/security/advisories/GHSA-w6c3-pxvr-6m6j
CVE ID: CVE-2025-64099 State: PUBLISHED Published: 2025-11-12T18:57:34.036Z Last Updated: 2025-11-12T21:04:04.048Z Vendors: OpenIdentityPlatform Products: OpenAM Problem Types: CWE-74 Description: Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claims_parameter_supported" parameter is activated, it is possible, thanks to the "oidc-claims-extension.groovy" script, to inject the value of one's choice into a claim contained in the id_token or in the user_info. In the request of an authorize function, a claims parameter containing a JSON file can be injected. This JSON file allows attackers to customize the claims returned by the "id_token"
taining a JSON file can be injected. This JSON file allows attackers to customize the claims returned by the "id_token" and "user_info" files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, an attacker can choose the email address they want, and therefore assume any identity they choose. Version 16.0.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-39hr-239p-fhqc
CVE ID: CVE-2025-64100 State: PUBLISHED Published: 2025-10-29T17:54:51.997Z Last Updated: 2025-10-29T19:29:13.337Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: ckan Products: ckan Problem Types: CWE-384 Description: CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each log
e victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ckan/ckan/security/advisories/GHSA-2hvh-cw5c-8q8q - https://github.com/ckan/ckan/commit/c2fe437f88be850a6edf7a32470772428819fab5
CVE ID: CVE-2025-64101 State: PUBLISHED Published: 2025-10-29T18:30:14.999Z Last Updated: 2025-10-29T19:35:39.237Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: zitadel Products: zitadel Problem Types: CWE-601, CWE-640 Description: Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, a potential vulnerability exists in ZITADEL's password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. If an attacker can manipulate these headers (e.g., via host
link, containing a secret code, is then emailed to the user. If an attacker can manipulate these headers (e.g., via host header injection), they could cause ZITADEL to generate a password reset link pointing to a malicious domain controlled by the attacker. If the user clicks this manipulated link in the email, the secret reset code embedded in the URL can be captured by the attacker. This captured code could then be used to reset the user's password and gain unauthorized access to their account. It's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled. This vulnerability is fixed in 4
nts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-mwmh-7px9-4c23 - https://github.com/zitadel/zitadel/commit/72a5c33e6ac302b978d564bd049f9364f5a989b1
CVE ID: CVE-2025-64102 State: PUBLISHED Published: 2025-10-29T18:36:15.390Z Last Updated: 2025-10-30T14:53:53.184Z Vendors: zitadel Products: zitadel Problem Types: CWE-307 Description: Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Email OTP, or passwords using a lockout mechanism. The mechanism is not enabled by default and can cause a denial of service for the corresponding user if enabled. Additionally, the mitigation strategies were not fully implemented in the more recent resour
responding user if enabled. Additionally, the mitigation strategies were not fully implemented in the more recent resource-based APIs. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-xrw9-r35x-x878 - https://github.com/zitadel/zitadel/commit/b8db8cdf9cc8ea13f461758aef12457f8b7d972a
CVE ID: CVE-2025-64103 State: PUBLISHED Published: 2025-10-29T18:43:46.934Z Last Updated: 2025-10-30T14:51:19.189Z Vendors: zitadel Products: zitadel Problem Types: CWE-308, CWE-287 Description: Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors. Bypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code
multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-cfjq-28r2-4jv5 - https://github.com/zitadel/zitadel/commit/b284f8474eed0cba531905101619e7ae7963156b
CVE ID: CVE-2025-64104 State: PUBLISHED Published: 2025-10-29T18:55:06.129Z Last Updated: 2025-10-30T15:33:07.541Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: langchain-ai Products: langgraph Problem Types: CWE-89 Description: LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization, allowing attackers to inject arbitrary SQL and bypass access controls. This vulnerability is fixed in 2.0.11. Additional Analyst Notes: -
to inject arbitrary SQL and bypass access controls. This vulnerability is fixed in 2.0.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/langchain-ai/langgraph/security/advisories/GHSA-7p73-8jqx-23r8 - https://github.com/langchain-ai/langgraph/commit/bc9d45b476101e441cb1cc602dea03eb29232de4
CVE ID: CVE-2025-64106 State: PUBLISHED Published: 2025-11-04T22:48:14.832Z Last Updated: 2025-11-05T18:47:55.509Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: cursor Products: cursor Problem Types: CWE-78 Description: Cursor is a code editor built for programming with AI. In versions 1.7.28 and below, an input validation flaw in Cursor's MCP server installation enables specially crafted deep-links to bypass the standard security warnings and conceal executed commands from users if they choose to accept the server. If an attacker is able to convince a victim to navigate to a malicious deeplink, the victim will not see the correct speedbump modal, and if the
o convince a victim to navigate to a malicious deeplink, the victim will not see the correct speedbump modal, and if they choose to accept, will execute commands specified by the attackers deeplink. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cursor/cursor/security/advisories/GHSA-4575-fh42-7848
CVE ID: CVE-2025-64107 State: PUBLISHED Published: 2025-11-04T22:51:42.609Z Last Updated: 2025-11-07T14:26:57.543Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: cursor Products: cursor Problem Types: CWE-22 Description: Cursor is a code editor built for programming with AI. In versions 1.7.52 and below, manipulating internal settings may lead to RCE. Cursor detects path manipulation via forward slashes (./.cursor/./././././mcp.json etc.), and requires human approval to complete the operation. However, the same kind of manipulation using backslashes was not correctly detected, allowing an attacker who had already achieved prompt injection or some other level
kslashes was not correctly detected, allowing an attacker who had already achieved prompt injection or some other level of control to overwrite sensitive editor files without approval on Windows machines. This issue is fixed in version 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cursor/cursor/security/advisories/GHSA-2jr2-8wf5-v6pf
CVE ID: CVE-2025-64108 State: PUBLISHED Published: 2025-11-04T22:58:53.745Z Last Updated: 2025-11-07T14:26:51.902Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: cursor Products: cursor Problem Types: CWE-22, CWE-94 Description: Cursor is a code editor built for programming with AI. In versions 1.7.44 and below, various NTFS path quirks allow a prompt injection attacker to circumvent sensitive file protections and overwrite files which Cursor requires human approval to overwrite. Modification of some of the protected files can lead to RCE. Must be chained with a prompt injection or malicious model attach. Only affects systems supporting NTFS. This issue is fi
ust be chained with a prompt injection or malicious model attach. Only affects systems supporting NTFS. This issue is fixed in version 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cursor/cursor/security/advisories/GHSA-6r98-6qcw-rxrw
CVE ID: CVE-2025-64109 State: PUBLISHED Published: 2025-11-04T23:09:49.147Z Last Updated: 2025-11-07T14:26:45.734Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: cursor Products: cursor Problem Types: CWE-78 Description: Cursor is a code editor built for programming with AI. In versions and below, a vulnerability in the Cursor CLI Beta allowed an attacker to achieve remote code execution through the MCP (Model Context Protocol) server mechanism by uploading a malicious MCP configuration in .cursor/mcp.json file in a GitHub repository. Once a victim clones the project and opens it using Cursor CLI, the command to run the malicious MCP server is immediately exe
victim clones the project and opens it using Cursor CLI, the command to run the malicious MCP server is immediately executed without any warning, leading to potential code execution as soon as the command runs. This issue is fixed in version 2025.09.17-25b418f. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cursor/cursor/security/advisories/GHSA-4hwr-97q3-37w2
CVE ID: CVE-2025-64110 State: PUBLISHED Published: 2025-11-04T23:24:46.313Z Last Updated: 2025-11-07T14:26:39.262Z Vendors: cursor Products: cursor Problem Types: CWE-284 Description: Cursor is a code editor built for programming with AI. In versions 1.7.23 and below, a logic bug allows a malicious agent to read sensitive files that should be protected via cursorignore. An attacker who has already achieved prompt injection, or a malicious model, could create a new cursorignore file which can invalidate the configuration of pre-existing ones. This could allow a malicious agent to read protected files. This issue is fixed in version 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
nt to read protected files. This issue is fixed in version 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cursor/cursor/security/advisories/GHSA-vhc2-fjv4-wqch
CVE ID: CVE-2025-64112 State: PUBLISHED Published: 2025-10-30T17:47:01.280Z Last Updated: 2025-10-30T17:58:06.993Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: statamic Products: cms Problem Types: CWE-79 Description: Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This vulnerability is fixed in 5.22.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
st Notes: - CISA ADP Vulnrichment: References: - https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm - https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
CVE ID: CVE-2025-64114 State: PUBLISHED Published: 2025-11-05T23:30:59.120Z Last Updated: 2025-11-24T20:28:08.246Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: MacWarrior Products: clipbucket-v5 Problem Types: CWE-89 Description: ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - #151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through its ClipBucket Custom Fields plugin. The vulnerabilities require the Custom Fields plugin to be installed and accessible, and can only be exploited by users with administrative access to the plugin interface. This
be installed and accessible, and can only be exploited by users with administrative access to the plugin interface. This issue is fixed in version 5.5.2 - #. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-4g7x-j562-8g69 - https://github.com/MacWarrior/clipbucket-v5/commit/b7289923177fe533ae908654ee3cd65b63ffb008 - https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.2-%23152
CVE ID: CVE-2025-64115 State: PUBLISHED Published: 2025-10-30T17:39:19.330Z Last Updated: 2025-10-30T19:06:23.834Z Vendors: leepeuker Products: movary Problem Types: CWE-601 Description: Movary is a web application to track, rate and explore your movie watch history. Versions up to and including 0.68.0 use the HTTP Referer header value directly for redirects in multiple settings endpoints, allowing a crafted link to cause an open redirect to an attacker-controlled site and facilitate phishing. This vulnerability is fixed in 0.69.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/leepeuker/movary/security/advisories/GHSA-pm58-79jw-q79f - https://github.com/
ichment: References: - https://github.com/leepeuker/movary/security/advisories/GHSA-pm58-79jw-q79f - https://github.com/leepeuker/movary/pull/713 - https://github.com/leepeuker/movary/commit/716f703b4464ffdb0365c406f3660d275495769f
CVE ID: CVE-2025-64116 State: PUBLISHED Published: 2025-10-30T17:32:41.434Z Last Updated: 2025-10-31T16:50:03.914Z Vendors: leepeuker Products: movary Problem Types: CWE-601 Description: Movary is a web application to track, rate and explore your movie watch history. Prior to 0.69.0, the login page accepts a redirect parameter without validation, allowing attackers to redirect authenticated users to arbitrary external sites. This vulnerability is fixed in 0.69.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/leepeuker/movary/security/advisories/GHSA-7q72-x26x-7f8g - https://github.com/leepeuker/movary/pull/713 - https://github.com/leepeuker/movary/commit
visories/GHSA-7q72-x26x-7f8g - https://github.com/leepeuker/movary/pull/713 - https://github.com/leepeuker/movary/commit/716f703b4464ffdb0365c406f3660d275495769f
CVE ID: CVE-2025-64117 State: PUBLISHED Published: 2025-11-12T19:12:42.405Z Last Updated: 2025-11-12T21:36:36.884Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: Enalean Products: tuleap Problem Types: CWE-352 Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1761813675 and Tuleap Enterprise Edition prior to versions 16.13-5 and 16.12-8 don't have cross-site request forgery protection in the management of SVN commit rules and immutable tags. An attacker could use this vulnerability to trick victims into changing the commit rules or immutable tags o
table tags. An attacker could use this vulnerability to trick victims into changing the commit rules or immutable tags of a SVN repo. Tuleap Community Edition 16.13.99.1761813675, Tuleap Enterprise Edition 16.13-5, and Tuleap Enterprise Edition 16.12-8 contain a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-p2f7-qw8p-f2p7 - https://github.com/Enalean/tuleap/commit/f49419f63edbbaa31ce8417b737431d944827404 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=f49419f63edbbaa31ce8417b737431d944827404 - https://tuleap.net/plugins/tracker/?aid=45251
CVE ID: CVE-2025-64118 State: PUBLISHED Published: 2025-10-30T17:50:20.421Z Last Updated: 2025-10-30T18:42:19.663Z Vendors: isaacs Products: node-tar Problem Types: CWE-362, CWE-367 Description: node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph - https://github.com/isaacs/node-tar/issues/445 - https://github.com/isaacs/node-tar/pull/446 - https://github.c
2q-xqph - https://github.com/isaacs/node-tar/issues/445 - https://github.com/isaacs/node-tar/pull/446 - https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d
CVE ID: CVE-2025-64131 State: PUBLISHED Published: 2025-10-29T13:29:39.724Z Last Updated: 2025-11-04T21:14:22.397Z Vendors: Jenkins Project Products: Jenkins SAML Plugin Description: Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user's web browser and Jenkins to replay those requests, authenticating to Jenkins as that user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3613
CVE ID: CVE-2025-64132 State: PUBLISHED Published: 2025-10-29T13:29:40.401Z Last Updated: 2025-11-04T21:14:23.718Z Vendors: Jenkins Project Products: Jenkins MCP Server Plugin Description: Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3622