WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Oracle product: Oracle Communications / Install (Jenkins)✕
Overview 11 matches · 1 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 2 EPSS ≥ 0.5
11matches 1protected9.1% 1exploited9.1% 1CISA KEV9.1% 1public PoC9.1% 2EPSS ≥ 0.518.2%
Protected by Waratek 1 9.1% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 10 90.9% Outside Waratek scope 0 0.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 1 9.1% High 3 27.3% Medium 6 54.5% Low 1 9.1% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 9.1% partly blocked 0 0.0% not blocked 10 90.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 9.1% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 1 9.1% No public exploit 9 81.8%
split by peak 5 / quarter
No exploit published: 10Protected by Waratek: 1 Low: 1Medium: 6High: 3Critical: 1 not blocked: 10blocked by ARMR today: 1 No public exploit: 9Forecast only: 1Exploited: 1
Q1 242 Protected by Waratek1 No exploit published1 Critical1 High1 blocked by ARMR today1 not blocked1 Exploited1 Forecast only1 Q2 240 Q3 240 Q4 242 No exploit published2 Medium2 not blocked2 No public exploit2 Q1 250 Q2 250 Q3 250 Q4 255 No exploit published5 High1 Medium3 Low1 not blocked5 No public exploit5 Q1 262 No exploit published2 High1 Medium1 not blocked2 No public exploit2
Q1 24Q2 24Q3 24Q4 24Q1 25Q2 25Q3 25Q4 25Q1 26
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-27100 Medium 2026-02-18 No exploit published No public exploit Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.
CVE-2026-27099 High 2026-02-18 No exploit published No public exploit Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.
CVE-2025-67639 Low 2025-12-10 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.
CVE-2025-67638 Medium 2025-12-10 No exploit published No public exploit Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVE-2025-67637 Medium 2025-12-10 No exploit published No public exploit Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVE-2025-67636 Medium 2025-12-10 No exploit published No public exploit A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.
CVE-2025-67635 High 2025-12-10 No exploit published No public exploit Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
CVE-2024-47804 Medium 2024-10-02 No exploit published No public exploit If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk, allowing attackers with Item/Configure permission to save the item to persist it, effectively bypassing the item creation restriction.
CVE-2024-47803 Medium 2024-10-02 No exploit published No public exploit Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `secretTextarea` form field.
CVE-2024-23898 High 2024-01-24 No exploit published Forecast only Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
CVE-2024-23897 Critical 2024-01-24 Protected by Waratek Exploited Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.