JE
DevOps
Jenkins
On CISA KEVExploited in the wildRansomware-linked
301
CVEs
6
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 22High 62Medium 146Low 5
Watch
Add Jenkins to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2012-0785 | 7.5 | Feb 24 | Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11… Affected: before 1.424.2; before 1.447 |
| CVE-2019-10353 | 7.5 | Jul 17 | CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection Affected: through 2.176.1; through 2.185 |
| CVE-2018-1999043 | 7.5 | Aug 23 | A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiTokenAuthenticator.java that allows… Affected: through 2.121.2; through 2.137 |
| CVE-2018-1999002 | 7.5 | Jul 23 | A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers… Affected: through 2.121.1; 2.122 through 2.132 |
| CVE-2017-1000394 | 7.5 | Jan 26 | Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-fileupload library with the denial-of-service vulnerability known as CVE-2016-3092 Affected: through 2.73.1; through 2.83 |
| CVE-2015-7539 | 7.5 | Feb 3 | The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for… Affected: through 1.639; through 1.625.1 |
| CVE-2016-3726 | 7.4 | May 17 | Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks… Affected: through 1.651.1; through 2.2 |
| CVE-2026-84652 | 7.3 | Sep 2 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to… Affected: before 2.568.3; before 2.580 |
| CVE-2017-1000391 | 7.3 | Jan 26 | Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in… Affected: through 2.73.2; through 2.88 |
| CVE-2019-1003003 | 7.2 | Jan 22 | An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that… Affected: 2.158 and earlier, LTS 2.150.1 and earlier |
| CVE-2019-1003004 | 7.2 | Jan 22 | An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java… Affected: 2.158 and earlier, LTS 2.150.1 and earlier |
| CVE-2023-27899 | 7.0 | Mar 10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading… Affected: before 2.375.4; before 2.394 |