CVE-2026-57290Medium· 4.3▾ SunlitJenkins Priority Sorter Plugin has a CSRF vulnerability
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.3%
Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier does not require POST requests in an HTTP endpoint that saves the global job priority configuration.
This allows attackers to overwrite the global job priority configuration.
Priority Sorter Plugin 936.937.v5581d0b_2ccb_a_ requires POST requests for the affected HTTP endpoint.
org.jenkins-ci.plugins:PrioritySorter < 936.937.v5581d0bUpgrade to a patched release:
org.jenkins-ci.plugins:PrioritySorter 936.937.v5581d0bConnected by shared product, vendor, weakness, or advisory.
CVE-2026-57305Medium· 5.4Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability
CVE-2026-57292Medium· 5.4Jenkins Gitee Plugin has a cross-site request forgery vulnerability
CVE-2026-57298Medium· 5.4Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability
CVE-2026-57301High· 8.8Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE
CVE-2026-57303High· 7.1Jenkins Assembla Plugin has an XXE vulnerability
CVE-2026-57302Medium· 4.3Jenkins FitNesse Plugin stores passwords unencrypted