CVE-2026-57306

MediumCVSS 4.2/10Last modified Jun 26, 2026

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2026
Last modified: Jun 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-573074.2A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission CVE-2026-573089.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with CVE-2026-573099.3A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into UR CVE-2026-57319.8Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. S CVE-2026-573106.3Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password CVE-2026-573115.3Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to R CVE-2026-573127.1Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.CVE-2026-573136.5Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.CVE-2026-573147.1Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.CVE-2026-573158.5Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.CVE-2026-573166.5Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.CVE-2026-573177.1Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.