WaratekVRT Sign in
Reset
More filters (1)
Columns
Product: Jenkins✕
Overview 12 matches · 0 protected · 4 exploited · 1 CISA KEV · 11 public PoC · 6 EPSS ≥ 0.5
12matches 0protected0.0% 4exploited33.3% 1CISA KEV8.3% 11public PoC91.7% 6EPSS ≥ 0.550.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 12 100.0% No exploit published 0 0.0%
Critical 1 8.3% High 3 25.0% Medium 7 58.3% Low 1 8.3% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 12 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 33.3% Working exploit published 8 66.7% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 4 / year
Mitigation candidate: 12 Low: 1Medium: 7High: 3Critical: 1 not blocked: 12 Working exploit published: 8Exploited: 4
20132 Mitigation candidate2 Medium1 Low1 not blocked2 Exploited1 Working exploit published1 20140 20150 20161 Mitigation candidate1 High1 not blocked1 Working exploit published1 20171 Mitigation candidate1 Critical1 not blocked1 Exploited1 20181 Mitigation candidate1 High1 not blocked1 Working exploit published1 20191 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20204 Mitigation candidate4 Medium4 not blocked4 Working exploit published4 20210 20220 20231 Mitigation candidate1 High1 not blocked1 Exploited1 20240 20251 Mitigation candidate1 Medium1 not blocked1 Exploited1
2013201520172019202120232025
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-59474 Medium 2025-09-17 Mitigation candidate Exploited Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2020-2231 Medium 2020-08-12 Mitigation candidate Working exploit published Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.
CVE-2020-2230 Medium 2020-08-12 Mitigation candidate Working exploit published Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.
CVE-2020-2229 Medium 2020-08-12 Mitigation candidate Working exploit published Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.
CVE-2020-2103 Medium 2020-01-29 Mitigation candidate Working exploit published Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.
CVE-2019-10405 Medium 2019-09-25 Mitigation candidate Working exploit published Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
CVE-2018-1999002 High 2018-07-23 Mitigation candidate Working exploit published A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
CVE-2016-9299 Critical 2017-01-12 Mitigation candidate Exploited The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.
CVE-2016-0792 High 2016-04-07 Mitigation candidate Working exploit published Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
CVE-2013-5573 Medium 2013-12-31 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.
CVE-2013-0158 Low 2013-02-24 Mitigation candidate Exploited Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.