SEC.co
Emergency

By weakness (CWE)

CWE-311: related vulnerabilities

CVEs classified under CWE-311. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

Known exploited (KEV)CriticalHighMediumAll recent
  • CVE-2026-53442MEDIUM 5.3

    Jenkins fails to encrypt sensitive credentials when they are submitted via POST requests to update job configurations. Instead of storing these secrets securely, Jenkins saves them in plain text within job config.xml files on the controller. Any user with permission to read job details or anyone with file system access to the Jenkins controller can view these unencrypted secrets, creating a path for credential theft.