This advisory announces multiple vulnerabilities in these Jenkins plugins:
Script Security Plugin (a dependency of Pipeline Plugin, Matrix Project Plugin, and others)
Stored XSS vulnerability in Extra Columns Plugin
SECURITY-136 / CVE-2016-3101
The Extra Columns plugin rendered user-supplied HTML in tool tips without filtering them through the configured markup formatter.
Groovy sandbox protection incomplete in Script Security Plugin
SECURITY-258 / CVE-2016-3102
The Script Security plugin provides a Groovy sandbox implementation to other plugins that only allows whitelisted commands to be executed. This sandbox did not cover direct field access or get/set array operations.