WaratekVRT Sign in

High Credentials CVEs with no public exploit

9 CVEs, 1 protected by Waratek

Reset
More filters (1)
Columns
Product credentials✕
Overview 9 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
9matches 1protected11.1% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 11.1% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 8 88.9%
Critical 0 0.0% High 9 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 11.1% partly blocked 0 0.0% not blocked 8 88.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 9 100.0%
split by peak 3 / year
No exploit published: 8Protected by Waratek: 1 High: 9 not blocked: 8blocked by ARMR today: 1 No public exploit: 9
20191 No exploit published1 High1 not blocked1 No public exploit1 20200 20210 20223 No exploit published3 High3 not blocked3 No public exploit3 20231 No exploit published1 High1 not blocked1 No public exploit1 20241 No exploit published1 High1 not blocked1 No public exploit1 20251 No exploit published1 High1 not blocked1 No public exploit1 20262 Protected by Waratek1 No exploit published1 High2 blocked by ARMR today1 not blocked1 No public exploit2
20192020202120222023202420252026
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-48922 High 2026-05-27 Protected by Waratek No public exploit Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.
CVE-2026-42520 High 2026-04-29 No exploit published No public exploit Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.
CVE-2025-53650 High 2025-07-09 No exploit published No public exploit Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present in exception error messages that are written to the build log.
CVE-2024-47805 High 2024-10-02 No exploit published No public exploit Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.
CVE-2023-25767 High 2023-02-15 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connect to an attacker-specified web server.
CVE-2022-27198 High 2022-03-15 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.
CVE-2022-23117 High 2022-01-12 No exploit published No public exploit Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve all username/password credentials stored on the Jenkins controller.
CVE-2022-23116 High 2022-01-12 No exploit published No public exploit Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to decrypt secrets stored in Jenkins obtained through another method.
CVE-2019-10303 High 2019-04-18 No exploit published No public exploit Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins master where they could be viewed by users with access to the master file system.