Medium Jenkins CVEs
1,195 CVEs, 2 exploited, 67 protected by Waratek
Overview 1,195 matches · 67 protected · 2 exploited · 0 CISA KEV · 10 public PoC · 22 EPSS ≥ 0.5
Protected by Waratek
67
5.6%
Rule in development
0
0.0%
Mitigation candidate
10
0.8%
No exploit published
1,118
93.6%
blocked by ARMR today
67
5.6%
partly blocked
0
0.0%
not blocked
1,128
94.4%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
2
0.2%
Working exploit published
8
0.7%
Proof of concept only
0
0.0%
Forecast only
17
1.4%
No public exploit
1,168
97.7%
split by
peak 291 / year
20122
No exploit published2
Medium2
not blocked2
No public exploit2
20137
Mitigation candidate1
No exploit published6
Medium7
not blocked7
Working exploit published1
No public exploit6
201416
Protected by Waratek2
No exploit published14
Medium16
blocked by ARMR today2
not blocked14
No public exploit16
201513
Protected by Waratek2
No exploit published11
Medium13
blocked by ARMR today2
not blocked11
No public exploit13
20169
No exploit published9
Medium9
not blocked9
No public exploit9
201722
Protected by Waratek1
No exploit published21
Medium22
blocked by ARMR today1
not blocked21
No public exploit22
201897
Protected by Waratek3
No exploit published94
Medium97
blocked by ARMR today3
not blocked94
No public exploit97
2019180
Protected by Waratek6
Mitigation candidate2
No exploit published172
Medium180
blocked by ARMR today6
not blocked174
Working exploit published2
No public exploit178
2020167
Protected by Waratek12
Mitigation candidate6
No exploit published149
Medium167
blocked by ARMR today12
not blocked155
Exploited1
Working exploit published5
No public exploit161
202164
Protected by Waratek4
No exploit published60
Medium64
blocked by ARMR today4
not blocked60
Forecast only8
No public exploit56
2022291
Protected by Waratek20
No exploit published271
Medium291
blocked by ARMR today20
not blocked271
Forecast only6
No public exploit285
2023165
Protected by Waratek10
No exploit published155
Medium165
blocked by ARMR today10
not blocked155
Forecast only2
No public exploit163
202429
Protected by Waratek1
No exploit published28
Medium29
blocked by ARMR today1
not blocked28
Forecast only1
No public exploit28
202579
Mitigation candidate1
No exploit published78
Medium79
not blocked79
Exploited1
No public exploit78
202654
Protected by Waratek6
No exploit published48
Medium54
blocked by ARMR today6
not blocked48
No public exploit54
20122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-117623 | Medium | 2026-10-28 | No exploit published | No public exploit | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission. |
| CVE-2026-117622 | Medium | 2026-10-28 | No exploit published | No public exploit | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes. |
| CVE-2026-117621 | Medium | 2026-10-28 | No exploit published | No public exploit | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes. |
| CVE-2026-117615 | Medium | 2026-10-28 | No exploit published | No public exploit | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system. |
| CVE-2026-117613 | Medium | 2026-10-28 | Protected by Waratek | No public exploit | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted `config.xml` files that can lead to, e.g., stored cross-site scripting (XSS) vulnerabilities. |
| CVE-2026-84659 | Medium | 2026-09-02 | No exploit published | No public exploit | Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding. |
| CVE-2026-84658 | Medium | 2026-09-02 | No exploit published | No public exploit | Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration. |
| CVE-2026-84657 | Medium | 2026-09-02 | No exploit published | No public exploit | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users. |
| CVE-2026-84656 | Medium | 2026-09-02 | No exploit published | No public exploit | A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to. |
| CVE-2026-84655 | Medium | 2026-09-02 | No exploit published | No public exploit | Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses. |
| CVE-2026-84651 | Medium | 2026-09-02 | No exploit published | No public exploit | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure permission on one agent to take over a different agent, gaining control of its configuration and obtaining access to its inbound agent secret and environment variables. |
| CVE-2026-84646 | Medium | 2026-09-02 | Protected by Waratek | No public exploit | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML. |
| CVE-2026-70428 | Medium | 2026-08-05 | Protected by Waratek | No public exploit | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system. |
| CVE-2026-70427 | Medium | 2026-08-05 | No exploit published | No public exploit | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins. |
| CVE-2026-57307 | Medium | 2026-06-24 | No exploit published | No public exploit | A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. |
| CVE-2026-57306 | Medium | 2026-06-24 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. |
| CVE-2026-57305 | Medium | 2026-06-24 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified username and password. |
| CVE-2026-57304 | Medium | 2026-06-24 | No exploit published | No public exploit | A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password. |
| CVE-2026-57302 | Medium | 2026-06-24 | No exploit published | No public exploit | Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system. |
| CVE-2026-57300 | Medium | 2026-06-24 | No exploit published | No public exploit | A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access. |
| CVE-2026-57299 | Medium | 2026-06-24 | No exploit published | No public exploit | Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata. |
| CVE-2026-57297 | Medium | 2026-06-24 | No exploit published | No public exploit | A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key. |
| CVE-2026-57295 | Medium | 2026-06-24 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins. |
| CVE-2026-57294 | Medium | 2026-06-24 | No exploit published | No public exploit | A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins. |
| CVE-2026-57290 | Medium | 2026-06-24 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration. |
| CVE-2026-57289 | Medium | 2026-06-24 | No exploit published | No public exploit | Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to capture the token. |
| CVE-2026-57287 | Medium | 2026-06-24 | No exploit published | No public exploit | Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted. |
| CVE-2026-57286 | Medium | 2026-06-24 | No exploit published | No public exploit | A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository used by a job, such as branch names, tag names, and revision metadata. |
| CVE-2026-57285 | Medium | 2026-06-24 | No exploit published | No public exploit | A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration. |
| CVE-2026-57284 | Medium | 2026-06-24 | No exploit published | No public exploit | Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to instantiate types related to job or system configuration other than Pipeline steps. |
| CVE-2026-57283 | Medium | 2026-06-24 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types related to job or system configuration other than Pipeline steps through the Pipeline Snippet Generator. |
| CVE-2026-57282 | Medium | 2026-06-24 | No exploit published | No public exploit | Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH wrapper script, allowing attackers able to control the name of a build's working directory to execute arbitrary operating system commands on the agent. |
| CVE-2026-53442 | Medium | 2026-06-10 | No exploit published | No public exploit | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system. |
| CVE-2026-53441 | Medium | 2026-06-10 | No exploit published | No public exploit | Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission. |
| CVE-2026-53440 | Medium | 2026-06-10 | No exploit published | No public exploit | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain. |
| CVE-2026-53439 | Medium | 2026-06-10 | No exploit published | No public exploit | Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine other users' configured timezone and to enumerate view names of other users' "My Views". |
| CVE-2026-53438 | Medium | 2026-06-10 | No exploit published | No public exploit | A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read permission, to cancel queue items they do not have permission to view. |
| CVE-2026-53436 | Medium | 2026-06-10 | No exploit published | No public exploit | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains relative path segments (`./` or `../`), allowing attackers to perform phishing attacks. |
| CVE-2026-9674 | Medium | 2026-05-27 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failed Multijob builds. |
| CVE-2026-48927 | Medium | 2026-05-27 | No exploit published | No public exploit | Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or views. |
| CVE-2026-48926 | Medium | 2026-05-27 | No exploit published | No public exploit | Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. |
| CVE-2026-48924 | Medium | 2026-05-27 | No exploit published | No public exploit | Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks. |
| CVE-2026-48923 | Medium | 2026-05-27 | No exploit published | No public exploit | Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL. |
| CVE-2026-48919 | Medium | 2026-05-27 | Protected by Waratek | No public exploit | Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation. |
| CVE-2026-48918 | Medium | 2026-05-27 | No exploit published | No public exploit | Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default. |
| CVE-2026-48917 | Medium | 2026-05-27 | Protected by Waratek | No public exploit | Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation. |
| CVE-2026-48916 | Medium | 2026-05-27 | No exploit published | No public exploit | Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals. |
| CVE-2026-42525 | Medium | 2026-04-29 | No exploit published | No public exploit | Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks. |
| CVE-2026-42522 | Medium | 2026-04-29 | No exploit published | No public exploit | A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials. |
| CVE-2026-42521 | Medium | 2026-04-29 | Protected by Waratek | No public exploit | Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath. |
| CVE-2026-42519 | Medium | 2026-04-29 | No exploit published | No public exploit | A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths. |
| CVE-2026-33004 | Medium | 2026-03-18 | No exploit published | No public exploit | Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2026-33003 | Medium | 2026-03-18 | No exploit published | No public exploit | Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2026-27100 | Medium | 2026-02-18 | No exploit published | No public exploit | Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name. |
| CVE-2025-67643 | Medium | 2025-12-10 | No exploit published | No public exploit | Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory. |
| CVE-2025-67642 | Medium | 2025-12-10 | No exploit published | No public exploit | Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to. |
| CVE-2025-67640 | Medium | 2025-12-10 | No exploit published | No public exploit | Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands. |
| CVE-2025-67638 | Medium | 2025-12-10 | No exploit published | No public exploit | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2025-67637 | Medium | 2025-12-10 | No exploit published | No public exploit | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2025-67636 | Medium | 2025-12-10 | No exploit published | No public exploit | A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views. |
| CVE-2025-64150 | Medium | 2025-10-29 | No exploit published | No public exploit | A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. |
| CVE-2025-64149 | Medium | 2025-10-29 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. |
| CVE-2025-64148 | Medium | 2025-10-29 | No exploit published | No public exploit | A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. |
| CVE-2025-64147 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2025-64146 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system. |
| CVE-2025-64145 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2025-64144 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system. |
| CVE-2025-64143 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system. |
| CVE-2025-64142 | Medium | 2025-10-29 | No exploit published | No public exploit | A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. |
| CVE-2025-64141 | Medium | 2025-10-29 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials. |
| CVE-2025-64139 | Medium | 2025-10-29 | No exploit published | No public exploit | A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
| CVE-2025-64138 | Medium | 2025-10-29 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL. |
| CVE-2025-64137 | Medium | 2025-10-29 | No exploit published | No public exploit | A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server. |
| CVE-2025-64136 | Medium | 2025-10-29 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server. |
| CVE-2025-64135 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime. |
| CVE-2025-64133 | Medium | 2025-10-29 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code. |
| CVE-2025-64132 | Medium | 2025-10-29 | No exploit published | No public exploit | Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access. |
| CVE-2025-59476 | Medium | 2025-09-17 | No exploit published | No public exploit | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output. |
| CVE-2025-59475 | Medium | 2025-09-17 | No exploit published | No public exploit | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed). |
| CVE-2025-59474 | Medium | 2025-09-17 | Mitigation candidate | Exploited | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget. |
| CVE-2025-58460 | Medium | 2025-09-03 | No exploit published | No public exploit | A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. |
| CVE-2025-58459 | Medium | 2025-09-03 | No exploit published | No public exploit | Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs. |
| CVE-2025-58458 | Medium | 2025-09-03 | No exploit published | No public exploit | In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying `amazon-s3` protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. |
| CVE-2025-53743 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2025-53742 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2025-53678 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system. |
| CVE-2025-53677 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for attackers to observe and capture it. |
| CVE-2025-53676 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system. |
| CVE-2025-53675 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2025-53674 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, increasing the potential for attackers to observe and capture it. |
| CVE-2025-53673 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system. |
| CVE-2025-53672 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system. |
| CVE-2025-53671 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2025-53670 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2025-53669 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2025-53668 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2025-53667 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2025-53666 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2025-53665 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Apica Loadtest Plugin 1.10 and earlier does not mask Apica Loadtest LTP authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2025-53664 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |