Jenkins Project Jenkins Bitbucket Push and Pull Request Plugin

• CVE-2026-92139 Medium 6.5 Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those UR 0.2%
• CVE-2026-57289 Medium 4.8 Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the 0.2%
• CVE-2023-41937 Unrated Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to 0.7%