Overview 1,590 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 20 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1,590
100.0%
Outside Waratek scope
0
0.0%
Not applicable
0
0.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
1,590
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
1
0.1%
Forecast only
20
1.3%
No public exploit
1,569
98.7%
split by
peak 345 / year
20111
No exploit published1
Low1
not blocked1
No public exploit1
20122
No exploit published2
Medium2
not blocked2
No public exploit2
20138
No exploit published8
High1
Medium6
Low1
not blocked8
No public exploit8
201419
No exploit published19
High2
Medium14
Low3
not blocked19
No public exploit19
201514
No exploit published14
High2
Medium11
Low1
not blocked14
No public exploit14
201614
No exploit published14
Critical1
High4
Medium9
not blocked14
No public exploit14
201735
No exploit published35
Critical2
High10
Medium21
Low2
not blocked35
No public exploit35
2018135
No exploit published135
High37
Medium94
Low4
not blocked135
No public exploit135
2019303
No exploit published303
Critical9
High118
Medium172
Low4
not blocked303
No public exploit303
2020181
No exploit published181
Critical5
High24
Medium149
Low3
not blocked181
No public exploit181
202184
No exploit published84
Critical8
High16
Medium60
not blocked84
Forecast only9
No public exploit75
2022345
No exploit published345
Critical8
High64
Medium271
Low2
not blocked345
Proof of concept only1
Forecast only6
No public exploit338
2023230
No exploit published230
Critical8
High62
Medium155
Low5
not blocked230
Forecast only2
No public exploit228
202446
No exploit published46
Critical1
High16
Medium28
Low1
not blocked46
Forecast only3
No public exploit43
202594
No exploit published94
Critical3
High11
Medium78
Low2
not blocked94
No public exploit94
202679
No exploit published79
Critical1
High27
Medium48
Low3
not blocked79
No public exploit79
20122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-117623 | Medium | 2026-10-28 | No exploit published | No public exploit | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission. |
| CVE-2026-117622 | Medium | 2026-10-28 | No exploit published | No public exploit | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes. |
| CVE-2026-117621 | Medium | 2026-10-28 | No exploit published | No public exploit | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes. |
| CVE-2026-117620 | High | 2026-10-28 | No exploit published | No public exploit | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords. |
| CVE-2026-117619 | High | 2026-10-28 | No exploit published | No public exploit | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after the API token is revoked or expires. |
| CVE-2026-117618 | High | 2026-10-28 | No exploit published | No public exploit | In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced. |
| CVE-2026-117617 | High | 2026-10-28 | No exploit published | No public exploit | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system. |
| CVE-2026-117615 | Medium | 2026-10-28 | No exploit published | No public exploit | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system. |
| CVE-2026-117614 | High | 2026-10-28 | No exploit published | No public exploit | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM. |
| CVE-2026-117612 | High | 2026-10-28 | No exploit published | No public exploit | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization. |
| CVE-2026-92129 | High | 2026-09-16 | No exploit published | No public exploit | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute code outside the sandbox. |
| CVE-2026-92128 | High | 2026-09-16 | No exploit published | No public exploit | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM. |
| CVE-2026-92127 | High | 2026-09-16 | No exploit published | No public exploit | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM. |
| CVE-2026-92125 | High | 2026-09-16 | No exploit published | No public exploit | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox protection and executing arbitrary code in the context of the Jenkins controller JVM. |
| CVE-2026-92124 | High | 2026-09-16 | No exploit published | No public exploit | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast on the collection itself, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. |
| CVE-2026-92123 | High | 2026-09-16 | No exploit published | No public exploit | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribute accesses, and array accesses), allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. |
| CVE-2026-92122 | High | 2026-09-16 | No exploit published | No public exploit | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. |
| CVE-2026-84659 | Medium | 2026-09-02 | No exploit published | No public exploit | Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding. |
| CVE-2026-84658 | Medium | 2026-09-02 | No exploit published | No public exploit | Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration. |
| CVE-2026-84657 | Medium | 2026-09-02 | No exploit published | No public exploit | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users. |
| CVE-2026-84656 | Medium | 2026-09-02 | No exploit published | No public exploit | A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to. |
| CVE-2026-84655 | Medium | 2026-09-02 | No exploit published | No public exploit | Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses. |
| CVE-2026-84653 | Low | 2026-09-02 | No exploit published | No public exploit | Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to. |
| CVE-2026-84652 | High | 2026-09-02 | No exploit published | No public exploit | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacker access to Jenkins as that user. |
| CVE-2026-84651 | Medium | 2026-09-02 | No exploit published | No public exploit | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure permission on one agent to take over a different agent, gaining control of its configuration and obtaining access to its inbound agent secret and environment variables. |
| CVE-2026-84648 | High | 2026-09-02 | No exploit published | No public exploit | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes. |
| CVE-2026-84645 | High | 2026-09-02 | No exploit published | No public exploit | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the global configuration and jobs) can appear as nested field values in user-submitted `config.xml` documents and subsequently handle HTTP requests via Stapler, resulting in remote code execution. |
| CVE-2026-70430 | Low | 2026-08-05 | No exploit published | No public exploit | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those intended for configuration only by administrators. |
| CVE-2026-70429 | High | 2026-08-05 | No exploit published | No public exploit | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in some circumstances. |
| CVE-2026-70427 | Medium | 2026-08-05 | No exploit published | No public exploit | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins. |
| CVE-2026-57307 | Medium | 2026-06-24 | No exploit published | No public exploit | A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. |
| CVE-2026-57306 | Medium | 2026-06-24 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. |
| CVE-2026-57305 | Medium | 2026-06-24 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified username and password. |
| CVE-2026-57304 | Medium | 2026-06-24 | No exploit published | No public exploit | A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password. |
| CVE-2026-57302 | Medium | 2026-06-24 | No exploit published | No public exploit | Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system. |
| CVE-2026-57301 | High | 2026-06-24 | No exploit published | No public exploit | Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller. |
| CVE-2026-57300 | Medium | 2026-06-24 | No exploit published | No public exploit | A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access. |
| CVE-2026-57299 | Medium | 2026-06-24 | No exploit published | No public exploit | Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata. |
| CVE-2026-57297 | Medium | 2026-06-24 | No exploit published | No public exploit | A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key. |
| CVE-2026-57295 | Medium | 2026-06-24 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins. |
| CVE-2026-57294 | Medium | 2026-06-24 | No exploit published | No public exploit | A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins. |
| CVE-2026-57290 | Medium | 2026-06-24 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration. |
| CVE-2026-57289 | Medium | 2026-06-24 | No exploit published | No public exploit | Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to capture the token. |
| CVE-2026-57288 | Low | 2026-06-24 | No exploit published | No public exploit | Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name. |
| CVE-2026-57287 | Medium | 2026-06-24 | No exploit published | No public exploit | Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted. |
| CVE-2026-57286 | Medium | 2026-06-24 | No exploit published | No public exploit | A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository used by a job, such as branch names, tag names, and revision metadata. |
| CVE-2026-57285 | Medium | 2026-06-24 | No exploit published | No public exploit | A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration. |
| CVE-2026-57284 | Medium | 2026-06-24 | No exploit published | No public exploit | Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to instantiate types related to job or system configuration other than Pipeline steps. |
| CVE-2026-57283 | Medium | 2026-06-24 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types related to job or system configuration other than Pipeline steps through the Pipeline Snippet Generator. |
| CVE-2026-57282 | Medium | 2026-06-24 | No exploit published | No public exploit | Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH wrapper script, allowing attackers able to control the name of a build's working directory to execute arbitrary operating system commands on the agent. |
| CVE-2026-57281 | High | 2026-06-24 | No exploit published | No public exploit | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script. |
| CVE-2026-57280 | High | 2026-06-24 | No exploit published | No public exploit | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection. |
| CVE-2026-53442 | Medium | 2026-06-10 | No exploit published | No public exploit | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system. |
| CVE-2026-53441 | Medium | 2026-06-10 | No exploit published | No public exploit | Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission. |
| CVE-2026-53440 | Medium | 2026-06-10 | No exploit published | No public exploit | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain. |
| CVE-2026-53439 | Medium | 2026-06-10 | No exploit published | No public exploit | Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine other users' configured timezone and to enumerate view names of other users' "My Views". |
| CVE-2026-53438 | Medium | 2026-06-10 | No exploit published | No public exploit | A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read permission, to cancel queue items they do not have permission to view. |
| CVE-2026-53437 | High | 2026-06-10 | No exploit published | No public exploit | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks. |
| CVE-2026-53436 | Medium | 2026-06-10 | No exploit published | No public exploit | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains relative path segments (`./` or `../`), allowing attackers to perform phishing attacks. |
| CVE-2026-9674 | Medium | 2026-05-27 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failed Multijob builds. |
| CVE-2026-48927 | Medium | 2026-05-27 | No exploit published | No public exploit | Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or views. |
| CVE-2026-48926 | Medium | 2026-05-27 | No exploit published | No public exploit | Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. |
| CVE-2026-48924 | Medium | 2026-05-27 | No exploit published | No public exploit | Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks. |
| CVE-2026-48923 | Medium | 2026-05-27 | No exploit published | No public exploit | Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL. |
| CVE-2026-48921 | High | 2026-05-27 | No exploit published | No public exploit | Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem. |
| CVE-2026-48920 | High | 2026-05-27 | No exploit published | No public exploit | Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem. |
| CVE-2026-48918 | Medium | 2026-05-27 | No exploit published | No public exploit | Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default. |
| CVE-2026-48916 | Medium | 2026-05-27 | No exploit published | No public exploit | Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals. |
| CVE-2026-42525 | Medium | 2026-04-29 | No exploit published | No public exploit | Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks. |
| CVE-2026-42524 | High | 2026-04-29 | No exploit published | No public exploit | Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2026-42523 | Critical | 2026-04-29 | No exploit published | No public exploit | Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission. |
| CVE-2026-42522 | Medium | 2026-04-29 | No exploit published | No public exploit | A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials. |
| CVE-2026-42520 | High | 2026-04-29 | No exploit published | No public exploit | Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node. |
| CVE-2026-42519 | Medium | 2026-04-29 | No exploit published | No public exploit | A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths. |
| CVE-2026-33004 | Medium | 2026-03-18 | No exploit published | No public exploit | Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2026-33003 | Medium | 2026-03-18 | No exploit published | No public exploit | Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2026-33002 | High | 2026-03-18 | No exploit published | No public exploit | Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation. |
| CVE-2026-27100 | Medium | 2026-02-18 | No exploit published | No public exploit | Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name. |
| CVE-2026-27099 | High | 2026-02-18 | No exploit published | No public exploit | Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission. |
| CVE-2025-67643 | Medium | 2025-12-10 | No exploit published | No public exploit | Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory. |
| CVE-2025-67642 | Medium | 2025-12-10 | No exploit published | No public exploit | Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to. |
| CVE-2025-67641 | High | 2025-12-10 | No exploit published | No public exploit | Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability. |
| CVE-2025-67640 | Medium | 2025-12-10 | No exploit published | No public exploit | Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands. |
| CVE-2025-67639 | Low | 2025-12-10 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account. |
| CVE-2025-67638 | Medium | 2025-12-10 | No exploit published | No public exploit | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2025-67637 | Medium | 2025-12-10 | No exploit published | No public exploit | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2025-67636 | Medium | 2025-12-10 | No exploit published | No public exploit | A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views. |
| CVE-2025-67635 | High | 2025-12-10 | No exploit published | No public exploit | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service. |
| CVE-2025-64150 | Medium | 2025-10-29 | No exploit published | No public exploit | A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. |
| CVE-2025-64149 | Medium | 2025-10-29 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. |
| CVE-2025-64148 | Medium | 2025-10-29 | No exploit published | No public exploit | A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. |
| CVE-2025-64147 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2025-64146 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system. |
| CVE-2025-64145 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2025-64144 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system. |
| CVE-2025-64143 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system. |
| CVE-2025-64142 | Medium | 2025-10-29 | No exploit published | No public exploit | A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. |
| CVE-2025-64141 | Medium | 2025-10-29 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials. |
| CVE-2025-64140 | High | 2025-10-29 | No exploit published | No public exploit | Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands. |
| CVE-2025-64139 | Medium | 2025-10-29 | No exploit published | No public exploit | A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |