JE
DevOps
Jenkins
On CISA KEVExploited in the wildRansomware-linked
302
CVEs
6
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 22High 62Medium 147Low 5
Watch
Add Jenkins to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-117612 New | – | Oct 28 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization Affected: All versions, or not specified |
| CVE-2015-5326 | – | Nov 25 | Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to… Affected: through 1.637; through 1.625.1 |
| CVE-2015-5325 | – | Nov 25 | Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave Affected: through 1.625.1; through 1.637 |
| CVE-2015-5324 | – | Nov 25 | Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api Affected: through 1.625.1; through 1.637 |
| CVE-2015-5323 | – | Nov 25 | Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an… Affected: through 1.625.1; through 1.637 |
| CVE-2015-5322 | – | Nov 25 | Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet… Affected: through 1.637; through 1.625.1 |
| CVE-2015-5321 | – | Nov 25 | The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct… Affected: through 1.625.1; through 1.637 |
| CVE-2015-5320 | – | Nov 25 | Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain… Affected: through 1.637; through 1.625.1 |
| CVE-2015-5319 | – | Nov 25 | XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted… Affected: through 1.625.1; through 1.637 |
| CVE-2015-5318 | – | Nov 25 | Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF… Affected: through 1.637; through 1.625.1 |
| CVE-2014-3665 | – | Nov 25 | Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote attackers to execute arbitrary code on… Affected: through 1.586; through 1.565.3 |
| CVE-2015-1814 | – | Oct 16 | The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users Affected: 1.596.1; through 1.605 |
| CVE-2015-1813 | – | Oct 16 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a… Affected: through 1.596.1; through 1.605 |
| CVE-2015-1812 | – | Oct 16 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a… Affected: through 1.596.1; through 1.605 |
| CVE-2015-1810 | – | Oct 16 | The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting,… Affected: through 1.580.3; through 1.599 |
| CVE-2015-1808 | – | Oct 16 | Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data Affected: through 1.580.3; through 1.599 |
| CVE-2015-1807 | – | Oct 16 | Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink,… Affected: through 1.580.3; through 1.599 |
| CVE-2015-1806 | – | Oct 16 | The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and… Affected: through 1.580.3; through 1.599 |
| CVE-2014-2068 | – | Oct 17 | The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER… Affected: through 1.550; through 1.532.1 |
| CVE-2014-2066 | – | Oct 17 | Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins… Affected: through 1.532.1; through 1.550 |
| CVE-2014-2065 | – | Oct 17 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the iconSize cookie Affected: through 1.532.1; through 1.550 |
| CVE-2014-2064 | – | Oct 17 | The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a… Affected: through 1.532.1; through 1.550 |
| CVE-2014-2063 | – | Oct 17 | Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors Affected: through 1.550; through 1.532.1 |
| CVE-2014-2062 | – | Oct 17 | Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token Affected: through 1.532.1; through 1.550 |
| CVE-2014-2061 | – | Oct 17 | The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code,… Affected: through 1.532.1; through 1.550 |
| CVE-2014-2060 | – | Oct 17 | The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors Affected: through 1.550; through 1.532.1 |
| CVE-2014-2058 | – | Oct 17 | BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to… Affected: through 1.532.1; through 1.550 |
| CVE-2013-7330 | – | Oct 17 | Jenkins before 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related to post-build actions Affected: through 1.501 |
| CVE-2014-3680 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized… Affected: through 1.565.2; through 1.582 |
| CVE-2014-3667 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain… Affected: through 1.582; through 1.565.2 |
| CVE-2014-3666 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel Affected: through 1.582; through 1.565.2 |
| CVE-2014-3663 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary… Affected: through 1.565.2; through 1.582 |
| CVE-2014-3662 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts Affected: through 1.582; through 1.565.2 |
| CVE-2014-3661 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake Affected: through 1.582; through 1.565.2 |
| CVE-2014-3681 | – | Oct 15 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: before 1.565.3; before 1.583 |
| CVE-2014-3664 | – | Oct 15 | Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via… Affected: through 1.565.2; through 1.582 |
| CVE-2013-2033 | – | Apr 10 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote… Affected: before 1.509.1; before 1.514 |
| CVE-2014-2067 | – | Mar 1 | Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web… Affected: through 1.550; through 1.532.1 |
| CVE-2014-2059 | – | Mar 1 | Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to… Affected: through 1.532.1; through 1.550 |
| CVE-2013-5573 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field… Affected: 1.523 |
| CVE-2013-0331 | – | Mar 19 | Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload Affected: through 1.480.2; through 1.501 |
| CVE-2013-0330 | – | Mar 19 | Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors Affected: through 1.480.2; through 1.501 |
| CVE-2013-0329 | – | Mar 19 | Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown attack vectors Affected: through 1.480.2; through 1.501 |
| CVE-2013-0328 | – | Mar 19 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 1.501; through 1.480.2 |
| CVE-2013-0327 | – | Mar 19 | Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via… Affected: through 1.501; through 1.480.2 |
| CVE-2013-0158 | – | Feb 24 | Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is… Affected: 1.400; 1.401; 1.402; 1.403; 1.404; 1.405; +34 more |
| CVE-2012-6074 | – | Feb 24 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and… Affected: 1.400; 1.401; 1.402; 1.403; 1.404; 1.405; +34 more |
| CVE-2012-6073 | – | Feb 24 | Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before… Affected: through 1.466.2; 1.409.1; 1.409.2; 1.409.3; 1.424.1; 1.424.2; +34 more |
| CVE-2012-6072 | – | Feb 24 | CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before… Affected: through 1.466.2; 1.409.1; 1.409.2; 1.409.3; 1.424.1; 1.424.2; +34 more |
| CVE-2012-0325 | – | Mar 9 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows… Affected: 1.301; 1.302; 1.303; 1.304; 1.305; 1.306; +34 more |