High-Severity RCE and XSS Flaws Found in Popular CI/CD Jenkins Plugins

Jenkins published an advisory describing multiple plugin vulnerabilities—notably a high-severity path traversal in the Credentials Binding plugin that can lead to remote code execution, and stored XSS flaws in the GitHub and HTML Publisher plugins—plus several medium-severity issues (unsafe deserialization, missing permission checks, open redirect). Administrators are urged to apply the listed plugin updates immediately to mitigate widespread CI/CD exposure.