JE
Product
Jenkins
On CISA KEVExploited in the wildRansomware-linked
310
CVEs
6
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 22High 62Medium 153Low 7
Watch
Add Jenkins to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-53436 | 4.3 | Jun 10 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains relative path… Affected: before 2.555.3; before 2.568 |
| CVE-2026-27100 | 4.3 | Feb 18 | Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with… Affected: before 2.541.2; before 2.551 |
| CVE-2025-67638 | 4.3 | Dec 10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to… Affected: before 2.528.3; before 2.541 |
| CVE-2025-67637 | 4.3 | Dec 10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by… Affected: before 2.528.3; before 2.541 |
| CVE-2025-67636 | 4.3 | Dec 10 | A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views Affected: before 2.528.3; before 2.541 |
| CVE-2025-59475 | 4.3 | Sep 17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read… Affected: before 2.516.3; before 2.528 |
| CVE-2025-31721 | 4.3 | Apr 2 | A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy… Affected: before 2.492.3; before 2.504 |
| CVE-2025-31720 | 4.3 | Apr 2 | A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to… Affected: before 2.492.3; before 2.504 |
| CVE-2025-27625 | 4.3 | Mar 5 | In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attackers to perform phishing attacks by… Affected: before 2.492.2; before 2.500 |
| CVE-2025-27623 | 4.3 | Mar 5 | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowing attackers with… Affected: before 2.492.2; before 2.500 |
| CVE-2025-27622 | 4.3 | Mar 5 | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowing attackers with… Affected: before 2.492.2; before 2.500 |
| CVE-2024-47804 | 4.3 | Oct 2 | If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the… Affected: before 2.462.3; before 2.479 |
| CVE-2024-47803 | 4.3 | Oct 2 | Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `secretTextarea` form… Affected: before 2.462.3; before 2.479 |
| CVE-2023-43494 | 4.3 | Sep 20 | Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the… Affected: 2.50 before 2.424; 2.60.1 before 2.414.2 |
| CVE-2023-2631 | 4.3 | May 16 | CSRF vulnerability and missing permission checks in Code Dx Plugin Affected: through 3.1.0 |
| CVE-2023-2633 | 4.3 | May 16 | API keys stored and displayed in plain text by Code Dx Plugin Affected: through 3.1.0 |
| CVE-2023-2632 | 4.3 | May 16 | API keys stored and displayed in plain text by Code Dx Plugin Affected: through 3.1.0 |
| CVE-2023-2196 | 4.3 | May 16 | Missing permission checks in Code Dx Plugin Affected: through 3.1.0 |
| CVE-2023-27902 | 4.3 | Mar 8 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission to access their… Affected: before 2.375.4; before 2.394 |
| CVE-2022-20612 | 4.3 | Jan 12 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no… Affected: through 2.329; through LTS 2.319.1 |
| CVE-2021-21682 | 4.3 | Oct 6 | Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of… Affected: through 2.314; through LTS 2.303.1 |
| CVE-2021-21670 | 4.3 | Jun 30 | Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not… Affected: through 2.299; through LTS 2.289.1 |
| CVE-2021-21640 | 4.3 | Apr 7 | Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create… Affected: through 2.286; through LTS 2.277.1 |
| CVE-2021-21639 | 4.3 | Apr 7 | Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node,… Affected: through 2.286; through LTS 2.277.1 |
| CVE-2021-21606 | 4.3 | Jan 13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for… Affected: 2.242 before unspecified; through 2.274; through LTS 2.263.1 |
| CVE-2020-2251 | 4.3 | Sep 1 | Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier transmits project passwords in its configuration in plain text as part of job configuration forms, potentially… Affected: before 2.236 |
| CVE-2020-2104 | 4.3 | Jan 29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart Affected: through 2.218; through LTS 2.204.1 |
| CVE-2019-10354 | 4.3 | Jul 17 | A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission… Affected: 2.185 and earlier, LTS 2.176.1 and earlier |
| CVE-2018-1000862 | 4.3 | Dec 10 | An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to… Affected: through 2.138.3; through 2.153 |
| CVE-2018-1999046 | 4.3 | Aug 23 | A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows attackers With Overall/Read permission to… Affected: through 2.121.2; through 2.137 |
| CVE-2018-1999003 | 4.3 | Jul 23 | A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Overall/Read permission to cancel queued… Affected: through 2.121.1; 2.122 through 2.132 |
| CVE-2018-1999006 | 4.3 | Jul 23 | A exposure of sensitive information vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Plugin.java that allows attackers to determine the date and time when… Affected: through 2.121.1; through 2.132 |
| CVE-2018-1999004 | 4.3 | Jul 23 | A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to… Affected: through 2.121.1; 2.122 through 2.132 |
| CVE-2018-1000193 | 4.3 | Jun 5 | A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign… Affected: through 2.120; through 2.107.2 |
| CVE-2018-1000195 | 4.3 | Jun 5 | A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission… Affected: through 2.120; through 2.107.2 |
| CVE-2018-1000192 | 4.3 | Jun 5 | A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users with Overall/Read… Affected: through 2.120; through 2.107.2 |
| CVE-2017-2598 | 4.3 | May 23 | Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks… Affected: before 2.44; before 2.32.2 |
| CVE-2017-2609 | 4.3 | May 22 | jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385) Affected: before 2.32.2; before 2.44 |
| CVE-2017-2604 | 4.3 | May 15 | In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks… Affected: before 2.44; before 2.32.2 |
| CVE-2017-2602 | 4.3 | May 15 | jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem Affected: before 2.32.2; before 2.44 |
| CVE-2017-2600 | 4.3 | May 15 | In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API Affected: before 2.44; before 2.32.2 |
| CVE-2017-2606 | 4.3 | May 8 | Jenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that should not be visible (SECURITY-380) Affected: jenkins 2.44; jenkins 2.32.2 |
| CVE-2017-2611 | 4.3 | May 8 | Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389) Affected: jenkins 2.44; jenkins 2.32.2 |
| CVE-2017-1000400 | 4.3 | Jan 26 | The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/(job-name)/api contained information about upstream and downstream projects Affected: through 2.73.1; through 2.83 |
| CVE-2017-1000399 | 4.3 | Jan 26 | The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /queue/item/(ID)/api showed information about tasks in the queue (typically builds waiting to start) Affected: through 2.73.1; through 2.83 |
| CVE-2017-1000395 | 4.3 | Jan 26 | Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about Jenkins user accounts which is generally available to anyone with Overall/Read permissions via the… Affected: through 2.73.1; through 2.83 |
| CVE-2017-1000398 | 4.3 | Jan 26 | The remote API in Jenkins 2.73.1 and earlier, 2.83 and earlier at /computer/(agent-name)/api showed information about tasks (typically builds) currently running on that agent Affected: through 2.73.1; through 2.83 |
| CVE-2016-3723 | 4.3 | May 17 | Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions… Affected: through 2.2; through 1.651.1 |
| CVE-2016-3722 | 4.3 | May 17 | Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the "full name." Affected: through 1.651.1; through 2.2 |
| CVE-2016-3727 | 4.3 | May 17 | The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain… Affected: through 2.2; through 1.651.1 |