Jenkins Project Jenkins Contrast Continuous Application Security Plugin

• CVE-2026-57299 Medium 4.3 Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadat 0.2%
• CVE-2026-57298 Medium 5.4 A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers to have Jenkins connect to an attacker-specified URL usin 0.1%
• CVE-2026-57297 Medium 5.4 A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an at 0.2%
• CVE-2022-43420 Medium 5.4 Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report, resulting in a stored cross-site scripting (XS 0.8%