Jenkins security advisory

[Daniel Beck]

The following Jenkins updates contain fixes for security vulnerabilities:

* Jenkins 2.576
* Jenkins LTS 2.568.2

The following Jenkins plugin updates contain fixes for security vulnerabilities:

* External Workspace Manager Plugin 1.4.2
* HCL AppScan Plugin 1.8.4
* Multijob Plugin 677.v7ffc23d6a_4c2
* SCM-Manager Plugin 1.12.1
* Webhook Secret Credentials Provider Plugin 32.v09c9b_522f0a_8

Additionally, we announce unresolved security issues in the following plugins:

* AWS CodeBuild Plugin
* CodeSonar Plugin
* Google Chat Notification Plugin
* Horreum Plugin
* Ivy Report Plugin
* Parameterized Remote Trigger Plugin
* Qualys Container Scanning Connector Plugin
* Sauce OnDemand Plugin
* Summary Display Plugin
* Violation Comments to GitLab Plugin
* XML Job to Job DSL Plugin

Please see the advisory for more information:
https://www.jenkins.io/security/advisory/2026-08-05/