Jenkins Bitbucket Push And Pull Request vulnerabilities

2 CVEs affecting Jenkins Bitbucket Push And Pull Request, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-57289, published 2026-06-24.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-41937, published 2023-09-06. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to…
• CVE-2026-57289, published 2026-06-24. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to…