Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2025-64146
Medium · 4.3
CWE-311 Oct 29, 2025
Missing Encryption of Sensitive Data in Jenkins Curseforge Publisher
Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
CVE-2025-64145
Medium · 4.3
CWE-311 Oct 29, 2025
Missing Encryption of Sensitive Data in Jenkins Byteguard Build Actions
Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVE-2025-64144
Medium · 4.3
CWE-311 Oct 29, 2025
Missing Encryption of Sensitive Data in Jenkins Byteguard Build Actions
Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
CVE-2025-64143
Medium · 4.3
CWE-311 Oct 29, 2025
Missing Encryption of Sensitive Data in Jenkins Openshift Pipeline
Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
CVE-2025-48981
High · 8.6
CWE-311 Oct 7, 2025
An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows...
An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and manipulate data on the protocol because encryption is optional for this connection.