early signals oss-security infra

Multiple vulnerabilities in Jenkins

// AI summary

Jenkins releases 2.588 and LTS 2.580.2 contain fixes for multiple security vulnerabilities in the open source automation server used by developers.

// from the source

Posted by Kevin Guerroudj on Oct 28 Jenkins is an open source automation server which enables developers around the world to reliably build, test, and deploy their software. The following releases contain fixes for security vulnerabilities: * Jenkins 2.588 * Jenkins LTS 2.580.2 Summaries of the vulnerabilities are below. More details, severity, and attribution can be found here: https://www.jenkins.io/security/advisory/2026-10-28/ We provide advance notification for security...
Read at seclists.org ↗ More from oss-security

# more from oss-security

  1. oss-security infra

    CPython [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port

    seclists.org
  2. oss-security

    CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup

    seclists.org
  3. oss-security infra

    [OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642)

    seclists.org
  4. oss-security infra

    [OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638)

    seclists.org
  5. oss-security infra

    CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

    seclists.org