Login Request a demo
JE
Vendor
Jenkins
702 products with CVEs on record
1,849
CVEs
8
On KEV
15
New 30D
Products
JE
Jenkins
DevOps
9.9
301 CVEs6 on KEV15 new
SS
Script Security
Jenkins
9.9
45 CVEs1 on KEV0 new
PG
Pipeline: Groovy
Jenkins
9.9
14 CVEs1 on KEV0 new
AD
Active Directory
Jenkins
9.8
12 CVEs0 on KEV0 new
BO
Blue Ocean
Jenkins
8.8
11 CVEs0 on KEV0 new
EE
Email Extension
Jenkins
9.9
11 CVEs0 on KEV0 new
GI
Git
Jenkins
8.8
11 CVEs0 on KEV0 new
BF
Build Failure Analyzer
Jenkins
8.8
9 CVEs0 on KEV0 new
CF
Config File Provider
Jenkins
8.1
9 CVEs0 on KEV0 new
CA
Configuration AS Code
Jenkins
8.8
9 CVEs0 on KEV0 new
CB
Credentials Binding
Jenkins
7.5
8 CVEs0 on KEV0 new
GB
Github Branch Source
Jenkins
6.5
8 CVEs0 on KEV0 new
NI
Ns-nd Integration Performance Publisher
Jenkins
8.8
8 CVEs0 on KEV0 new
PG
Pipeline:shared Groovy Libraries
Jenkins
8.8
8 CVEs0 on KEV0 new
HP
Html Publisher
Jenkins
8.0
7 CVEs0 on KEV0 new
JC
Job Configuration History
Jenkins
8.8
7 CVEs0 on KEV0 new
KU
Kubernetes
Jenkins
8.8
7 CVEs0 on KEV0 new
OP
Openid
Jenkins
9.8
7 CVEs0 on KEV0 new
OC
Openid Connect Authentication
Jenkins
8.8
7 CVEs0 on KEV0 new
OD
Openshift Deployer
Jenkins
6.5
7 CVEs0 on KEV0 new
RU
Rundeck
Jenkins
8.8
7 CVEs0 on KEV0 new
SS
Saml Single Sign ON
Jenkins
8.8
7 CVEs0 on KEV0 new
SU
Subversion
Jenkins
7.5
7 CVEs0 on KEV0 new
AE
Amazon Ec2
Jenkins
8.8
6 CVEs0 on KEV0 new
AA
Azure AD
Jenkins
8.8
6 CVEs0 on KEV0 new
AV
Azure VM Agents
Jenkins
8.8
6 CVEs0 on KEV0 new
DD
Deployment Dashboard
Jenkins
5.4
6 CVEs0 on KEV0 new
EL
Electricflow
Jenkins
6.5
6 CVEs0 on KEV0 new
GT
Gerrit Trigger
Jenkins
8.8
6 CVEs0 on KEV0 new
GC
Git Client
Jenkins
8.8
6 CVEs0 on KEV0 new
GP
Git Parameter
Jenkins
8.2
6 CVEs0 on KEV0 new
GI
Github
Jenkins
9.0
6 CVEs0 on KEV0 new
GP
Github Pull Request Builder
Jenkins
8.8
6 CVEs0 on KEV0 new
GI
Gitlab
Jenkins
8.8
6 CVEs0 on KEV0 new
GC
Google Compute Engine
Jenkins
8.8
6 CVEs0 on KEV0 new
HV
Hashicorp Vault
Jenkins
7.5
6 CVEs0 on KEV0 new
PM
Pipeline Maven Integration
Jenkins
8.1
6 CVEs0 on KEV0 new
PI
Project Inheritance
Jenkins
6.5
6 CVEs0 on KEV0 new
RC
Repository Connector
Jenkins
7.8
6 CVEs0 on KEV0 new
WN
Warnings Next Generation
Jenkins
8.8
6 CVEs0 on KEV0 new
XX
Xebialabs XL Deploy
Jenkins
8.8
6 CVEs0 on KEV0 new
AC
Active Choices
Jenkins
5.4
5 CVEs0 on KEV0 new
AP
Appspider
Jenkins
8.8
5 CVEs0 on KEV0 new
AS
Assembla
Jenkins
8.8
5 CVEs0 on KEV0 new
AC
Aws Codecommit Trigger
Jenkins
6.5
5 CVEs0 on KEV0 new
CV
Cadence Vmanager
Jenkins
8.2
5 CVEs0 on KEV0 new
CS
Chef Sinatra
Jenkins
8.8
5 CVEs0 on KEV0 new
CD
Code DX
Jenkins
4.3
5 CVEs0 on KEV0 new
DE
Delphix
Jenkins
7.8
5 CVEs0 on KEV0 new
EC
Extended Choice Parameter
Jenkins
8.8
5 CVEs0 on KEV0 new
FO
Fortify
Jenkins
6.1
5 CVEs0 on KEV0 new
GL
Google Login
Jenkins
7.5
5 CVEs0 on KEV0 new
JI
Jira
Jenkins
9.9
5 CVEs0 on KEV0 new
JA
Job And Node Ownership
Jenkins
8.8
5 CVEs0 on KEV0 new
JI
Job Import
Jenkins
9.1
5 CVEs0 on KEV0 new
JU
Junit
Jenkins
8.3
5 CVEs0 on KEV0 new
MA
Mabl
Jenkins
8.8
5 CVEs0 on KEV0 new
MA
Mailer
Jenkins
8.0
5 CVEs0 on KEV0 new
MP
Matrix Project
Jenkins
9.9
5 CVEs0 on KEV0 new
ME
Mercurial
Jenkins
7.5
5 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-117626
New
JE
Jenkins
Jenkins
––Oct 28Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/,…
CVE-2026-117625
New
JE
Jenkins
Jenkins
––Oct 28A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy…
CVE-2026-117624
New
JE
Jenkins
Jenkins
––Oct 28Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in…
CVE-2026-117623
New
JE
Jenkins
Jenkins
––Oct 28Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site…
CVE-2026-117622
New
JE
Jenkins
Jenkins
––Oct 28Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site…
CVE-2026-117621
New
JE
Jenkins
Jenkins
––Oct 28Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site…
CVE-2026-117620
New
JE
Jenkins
Jenkins
––Oct 28Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by…
CVE-2026-117619
New
JE
Jenkins
Jenkins
––Oct 28Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie,…
CVE-2026-117618
New
JE
Jenkins
Jenkins
––Oct 28In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting…
CVE-2026-117617
New
JE
Jenkins
Jenkins
––Oct 28Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before…
CVE-2026-117616
New
JE
Jenkins
Jenkins
––Oct 28Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission…
CVE-2026-117615
New
JE
Jenkins
Jenkins
––Oct 28Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and…
CVE-2026-117614
New
JE
Jenkins
Jenkins
––Oct 28Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without…
CVE-2026-117613
New
JE
Jenkins
Jenkins
––Oct 28Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API…
CVE-2026-117612
New
JE
Jenkins
Jenkins
––Oct 28Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization
CVE-2026-92129
SS
Script Security
Jenkins
7.5
0%
Sep 16Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers…
CVE-2026-92128
SS
Script Security
Jenkins
7.5
0%
Sep 16Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the…
CVE-2026-92127
SS
Script Security
Jenkins
8.0
1%
Sep 16Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer…
CVE-2026-92126
SS
Script Security
Jenkins
8.5
1%
Sep 16Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers…
CVE-2026-92125
SS
Script Security
Jenkins
8.8
1%
Sep 16Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run…
CVE-2026-92124
SS
Script Security
Jenkins
8.8
1%
Sep 16Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script…
CVE-2026-92123
SS
Script Security
Jenkins
8.8
1%
Sep 16Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribute accesses, and…
CVE-2026-92122
SS
Script Security
Jenkins
8.8
1%
Sep 16Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an…
CVE-2026-84659
SS
Script Security
Jenkins
4.3
0%
Sep 2Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the…
CVE-2026-84658
SS
Script Security
Jenkins
4.3
0%
Sep 2Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing…
CVE-2026-84657
JE
Jenkins
Jenkins
4.2
0%
Sep 2In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait…
CVE-2026-84656
JE
Jenkins
Jenkins
4.3
0%
Sep 2A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and…
CVE-2026-84655
JE
Jenkins
Jenkins
4.3
0%
Sep 2Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control…
CVE-2026-84654
JE
Jenkins
Jenkins
5.4
0%
Sep 2In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting…
CVE-2026-84653
JE
Jenkins
Jenkins
3.5
0%
Sep 2Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page,…
CVE-2026-84652
JE
Jenkins
Jenkins
7.3
0%
Sep 2In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to…
CVE-2026-84651
JE
Jenkins
Jenkins
6.3
0%
Sep 2In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a…
CVE-2026-84650
JE
Jenkins
Jenkins
8.8
0%
Sep 2In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify…
CVE-2026-84649
JE
Jenkins
Jenkins
8.8
0%
Sep 2In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS…
CVE-2026-84648
JE
Jenkins
Jenkins
8.8
1%
Sep 2In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site…
CVE-2026-84647
JE
Jenkins
Jenkins
8.8
1%
Sep 2In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of…
CVE-2026-84646
JE
Jenkins
Jenkins
4.3
0%
Sep 2In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read…
CVE-2026-84645
JE
Jenkins
Jenkins
8.8
1%
Sep 2In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the…
CVE-2026-70430
JE
Jenkins
Jenkins
2.7
0%
Aug 5Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing…
CVE-2026-70429
JE
Jenkins
Jenkins
6.5
0%
Aug 5Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups…
CVE-2026-70428
JE
Jenkins
Jenkins
4.3
0%
Aug 5Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and…
CVE-2026-70427
JE
Jenkins
Jenkins
4.3
0%
Aug 5Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives,…
CVE-2026-70426
JE
Jenkins
Jenkins
9.0
1%
Aug 5In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied…
CVE-2026-57307
ZZ
Zowe Zdevops
Jenkins
4.2
0%
Jun 24A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified…
CVE-2026-57306
ZZ
Zowe Zdevops
Jenkins
4.2
0%
Jun 24A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL…
CVE-2026-57305
AS
Assembla
Jenkins
5.4
0%
Jun 24A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified…
CVE-2026-57304
AS
Assembla
Jenkins
5.4
0%
Jun 24A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an…
CVE-2026-57303
AS
Assembla
Jenkins
7.1
0%
Jun 24Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the…
CVE-2026-57302
FI
Fitnesse
Jenkins
4.3
0%
Jun 24Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read…
CVE-2026-57301
OO
Official Owasp Zap
Jenkins
8.8
1%
Jun 24Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to…
CVE-2026-57300
MS
Mcp Server
Jenkins
4.3
0%
Jun 24A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs…
CVE-2026-57299
CC
Contrast Continuous Application Security
Jenkins
4.3
0%
Jun 24Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of…
CVE-2026-57297
CC
Contrast Continuous Application Security
Jenkins
4.3
0%
Jun 24A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an…
CVE-2026-57295
EF
Ec2 Fleet
Jenkins
5.4
0%
Jun 24A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-specified URL using…
CVE-2026-57294
EF
Ec2 Fleet
Jenkins
5.4
0%
Jun 24A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL…
CVE-2026-57290
PS
Priority Sorter
Jenkins
4.3
0%
Jun 24A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority…
CVE-2026-57289
BP
Bitbucket Push And Pull Request
Jenkins
4.8
0%
Jun 24Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token…
CVE-2026-57288
AD
Active Directory
Jenkins
3.7
0%
Jun 24Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing…
CVE-2026-57287
JC
Job Configuration History
Jenkins
4.3
0%
Jun 24Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations,…
CVE-2026-57286
GP
Git Parameter
Jenkins
4.3
0%
Jun 24A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository…