JE
DevOps
Jenkins
On CISA KEVExploited in the wildRansomware-linked
302
CVEs
6
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 22High 62Medium 147Low 5
Watch
Add Jenkins to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-84653 | 3.5 | Sep 2 | Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page,… Affected: 2.421 through 2.579; 2.426.1 through 2.568.2 |
| CVE-2025-67639 | 3.5 | Dec 10 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account Affected: before 2.528.3; before 2.541 |
| CVE-2017-2603 | 3.5 | May 15 | Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API Affected: before 2.44; before 2.32.2 |
| CVE-2026-70430 | 2.7 | Aug 5 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing… Affected: before 2.568.2; before 2.576 |
| CVE-2017-1000401 | 2.2 | Jan 26 | The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form validation (e.g Affected: through 2.73.1; through 2.83 |
Showing 5