JS
Product
Jenkins Script Security Plugin
On CISA KEVExploited in the wild
22
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 5High 13Medium 4Low 0
Watch
Add Jenkins Script Security Plugin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-92125 | 8.8 | Sep 16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run… Affected: through 1415.v9a_f9b_3a_c253d |
| CVE-2026-92124 | 8.8 | Sep 16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script… Affected: through 1415.v9a_f9b_3a_c253d |
| CVE-2026-92123 | 8.8 | Sep 16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribute accesses, and… Affected: through 1415.v9a_f9b_3a_c253d |
| CVE-2026-92122 | 8.8 | Sep 16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an… Affected: through 1415.v9a_f9b_3a_c253d |
| CVE-2026-57280 | 8.8 | Jun 24 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy… Affected: through 1402.v94c9ce464861 |
| CVE-2024-34145 | 8.8 | May 2 | A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier… Affected: through 1335.vf07d9ce377a_e |
| CVE-2019-1003024 | 8.8 | Feb 20 | A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission… Affected: 1.52 and earlier |
| CVE-2019-1003005 | 8.8 | Feb 6 | A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in… Affected: 1.50 and earlier |
| CVE-2026-92126 | 8.5 | Sep 16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers… Affected: through 1415.v9a_f9b_3a_c253d |
| CVE-2026-92127 | 8.0 | Sep 16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer… Affected: through 1415.v9a_f9b_3a_c253d |
| CVE-2026-92129 | 7.5 | Sep 16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers… Affected: through 1415.v9a_f9b_3a_c253d |
| CVE-2026-92128 | 7.5 | Sep 16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the… Affected: through 1415.v9a_f9b_3a_c253d |
| CVE-2026-57281 | 7.5 | Jun 24 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run… Affected: through 1402.v94c9ce464861 |
Showing 13