Overview 36 matches · 0 exploited · 0 CISA KEV · 0 public PoC · 1 EPSS ≥ 0.5
Protected by Waratek
36
100.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
blocked by ARMR today
36
100.0%
partly blocked
0
0.0%
not blocked
0
0.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
1
2.8%
No public exploit
35
97.2%
split by
peak 13 / year
20181
Protected by Waratek1
Medium1
blocked by ARMR today1
No public exploit1
20192
Protected by Waratek2
Medium2
blocked by ARMR today2
No public exploit2
20207
Protected by Waratek7
Medium7
blocked by ARMR today7
No public exploit7
20213
Protected by Waratek3
Medium3
blocked by ARMR today3
No public exploit3
202213
Protected by Waratek13
Medium13
blocked by ARMR today13
No public exploit13
20236
Protected by Waratek6
Medium6
blocked by ARMR today6
Forecast only1
No public exploit5
20241
Protected by Waratek1
Medium1
blocked by ARMR today1
No public exploit1
20250
20263
Protected by Waratek3
Medium3
blocked by ARMR today3
No public exploit3
201820192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-48919 | Medium | 2026-05-27 | Protected by Waratek | No public exploit | Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation. |
| CVE-2026-48917 | Medium | 2026-05-27 | Protected by Waratek | No public exploit | Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation. |
| CVE-2026-42521 | Medium | 2026-04-29 | Protected by Waratek | No public exploit | Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath. |
| CVE-2024-23900 | Medium | 2024-01-24 | Protected by Waratek | No public exploit | Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers. |
| CVE-2023-46655 | Medium | 2023-10-25 | Protected by Waratek | No public exploit | Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are published during the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to publish arbitrary files from the Jenkins controller file system to the previously configured CloudBees CD server. |
| CVE-2023-41932 | Medium | 2023-09-06 | Protected by Waratek | No public exploit | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'. |
| CVE-2023-41930 | Medium | 2023-09-06 | Protected by Waratek | No public exploit | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was not created by the plugin. |
| CVE-2023-37942 | Medium | 2023-07-12 | Protected by Waratek | No public exploit | Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2023-32985 | Medium | 2023-05-16 | Protected by Waratek | Forecast only | Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. |
| CVE-2023-2196 | Medium | 2023-05-16 | Protected by Waratek | No public exploit | A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Item/Read permission to check for the existence of an attacker-specified file path on an agent file system. |
| CVE-2022-45386 | Medium | 2022-11-15 | Protected by Waratek | No public exploit | Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-41235 | Medium | 2022-09-21 | Protected by Waratek | No public exploit | Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system. |
| CVE-2022-41231 | Medium | 2022-09-21 | Protected by Waratek | No public exploit | Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins controller file system by providing a crafted file name to an API endpoint. |
| CVE-2022-36894 | Medium | 2022-07-27 | Protected by Waratek | No public exploit | An arbitrary file write vulnerability in Jenkins CLIF Performance Testing Plugin 64.vc0d66de1dfb_f and earlier allows attackers with Overall/Read permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content. |
| CVE-2022-36890 | Medium | 2022-07-27 | Protected by Waratek | No public exploit | Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. |
| CVE-2022-30949 | Medium | 2022-05-17 | Protected by Waratek | No public exploit | Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents. |
| CVE-2022-28148 | Medium | 2022-03-29 | Protected by Waratek | No public exploit | The file browser in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Item/Read permission to obtain the contents of arbitrary files on Windows controllers. |
| CVE-2022-28146 | Medium | 2022-03-29 | Protected by Waratek | No public exploit | Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps. |
| CVE-2022-27208 | Medium | 2022-03-15 | Protected by Waratek | No public exploit | Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create permission to read arbitrary files on the Jenkins controller. |
| CVE-2022-27203 | Medium | 2022-03-15 | Protected by Waratek | No public exploit | Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller. |
| CVE-2022-27201 | Medium | 2022-03-15 | Protected by Waratek | No public exploit | Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. |
| CVE-2022-25188 | Medium | 2022-02-15 | Protected by Waratek | No public exploit | Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configure permission to write or overwrite .xml files on the Jenkins controller file system with content not controllable by the attacker. |
| CVE-2022-23113 | Medium | 2022-01-12 | Protected by Waratek | No public exploit | Jenkins Publish Over SSH Plugin 1.22 and earlier performs a validation of the file name specifying whether it is present or not, resulting in a path traversal vulnerability allowing attackers with Item/Configure permission to discover the name of the Jenkins controller files. |
| CVE-2021-43576 | Medium | 2021-11-12 | Protected by Waratek | No public exploit | Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. |
| CVE-2021-21701 | Medium | 2021-11-12 | Protected by Waratek | No public exploit | Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2021-21672 | Medium | 2021-06-30 | Protected by Waratek | No public exploit | Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2020-2315 | Medium | 2020-11-04 | Protected by Waratek | No public exploit | Jenkins Visualworks Store Plugin 1.1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2020-2305 | Medium | 2020-11-04 | Protected by Waratek | No public exploit | Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2020-2304 | Medium | 2020-11-04 | Protected by Waratek | No public exploit | Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2020-2298 | Medium | 2020-10-08 | Protected by Waratek | No public exploit | Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2020-2293 | Medium | 2020-10-08 | Protected by Waratek | No public exploit | Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller. |
| CVE-2020-2247 | Medium | 2020-09-01 | Protected by Waratek | No public exploit | Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2020-2139 | Medium | 2020-03-09 | Protected by Waratek | No public exploit | An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwrite any file on the Jenkins master file system. |
| CVE-2019-16540 | Medium | 2019-11-21 | Protected by Waratek | No public exploit | A path traversal vulnerability in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete arbitrary files on the Jenkins master. |
| CVE-2019-10436 | Medium | 2019-10-16 | Protected by Waratek | No public exploit | An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master. |
| CVE-2018-1000175 | Medium | 2018-05-08 | Protected by Waratek | No public exploit | A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers able to configure the HTML Publisher build step to override arbitrary files on the Jenkins master. |