Overview 28 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
28matches
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
28
100.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
28
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
28
100.0%
split by
peak 14 / year
20195
No exploit published5
Medium5
not blocked5
No public exploit5
20202
No exploit published2
Medium2
not blocked2
No public exploit2
20210
20221
No exploit published1
Medium1
not blocked1
No public exploit1
20233
No exploit published3
Medium3
not blocked3
No public exploit3
20241
No exploit published1
Medium1
not blocked1
No public exploit1
202514
No exploit published14
Medium14
not blocked14
No public exploit14
20262
No exploit published2
Medium2
not blocked2
No public exploit2
20192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-84676 | Medium | 2026-09-02 | No exploit published | No public exploit | Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2026-53442 | Medium | 2026-06-10 | No exploit published | No public exploit | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system. |
| CVE-2025-64147 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2025-64146 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system. |
| CVE-2025-64145 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2025-64144 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system. |
| CVE-2025-64143 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system. |
| CVE-2025-53678 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system. |
| CVE-2025-53676 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system. |
| CVE-2025-53673 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system. |
| CVE-2025-53668 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2025-53666 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2025-53663 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2025-53659 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins QMetry Test Management Plugin 1.13 and earlier stores Qmetry Automation API Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2025-53653 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Aqua Security Scanner Plugin 3.2.8 and earlier stores Scanner Tokens for Aqua API unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2025-31728 | Medium | 2025-04-02 | No exploit published | No public exploit | Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2024-43382 | Medium | 2024-10-30 | No exploit published | No public exploit | Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypted stage without the additional layer of protection provided by client side encryption. |
| CVE-2023-37943 | Medium | 2023-07-12 | No exploit published | No public exploit | Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials. |
| CVE-2023-32982 | Medium | 2023-05-16 | No exploit published | No public exploit | Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2023-30523 | Medium | 2023-04-12 | No exploit published | No public exploit | Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2022-27206 | Medium | 2022-03-15 | No exploit published | No public exploit | Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. |
| CVE-2020-2250 | Medium | 2020-09-01 | No exploit published | No public exploit | Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system. |
| CVE-2020-2239 | Medium | 2020-09-01 | No exploit published | No public exploit | Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system. |
| CVE-2019-10363 | Medium | 2019-07-31 | No exploit published | No public exploit | Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form. |
| CVE-2019-1003095 | Medium | 2019-04-04 | No exploit published | No public exploit | Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. |
| CVE-2019-1003094 | Medium | 2019-04-04 | No exploit published | No public exploit | Jenkins Open STF Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. |
| CVE-2019-1003089 | Medium | 2019-04-04 | No exploit published | No public exploit | Jenkins Upload to pgyer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. |
| CVE-2019-1003088 | Medium | 2019-04-04 | No exploit published | No public exploit | Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. |