JE
DevOps
Jenkins
On CISA KEVExploited in the wildRansomware-linked
301
CVEs
6
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 22High 62Medium 146Low 5
Watch
Add Jenkins to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-2599 | 5.4 | Apr 11 | Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check Affected: before 2.32.2; before 2.44 |
| CVE-2015-7536 | 5.4 | Feb 3 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified… Affected: through 1.625.1; through 1.639 |
| CVE-2026-53442 | 5.3 | Jun 10 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job… Affected: before 2.555.3; before 2.568 |
| CVE-2025-59476 | 5.3 | Sep 17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing… Affected: before 2.516.3; before 2.528 |
| CVE-2025-59474 | 5.3 | Sep 17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read… Affected: before 2.516.3; before 2.528 |
| CVE-2023-27904 | 5.3 | Mar 10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about… Affected: before 2.375.4; before 2.394 |
| CVE-2021-21615 | 5.3 | Jan 26 | Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race… Affected: before 2.263.3; before 2.276 |
| CVE-2021-21609 | 5.3 | Jan 13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read… Affected: through 2.263.1; through 2.274 |
| CVE-2020-2102 | 5.3 | Jan 29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC Affected: through 2.204.1; through 2.218 |
| CVE-2020-2101 | 5.3 | Jan 29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to… Affected: through 2.204.1; through 2.218 |
| CVE-2018-1999042 | 5.3 | Aug 23 | A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an… Affected: through 2.121.2; through 2.137 |
| CVE-2018-1000169 | 5.3 | Apr 16 | An exposure of sensitive information vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in CLICommand.java and ViewOptionHandler.java that allows unauthorized… Affected: through 2.105; through 2.107.1 |
| CVE-2018-1000068 | 5.3 | Feb 16 | An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the… Affected: through 2.106; through 2.89.3 |
| CVE-2018-1000067 | 5.3 | Feb 16 | An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests… Affected: through 2.106; through 2.89.3 |
| CVE-2014-9635 | 5.3 | Sep 12 | Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to… Affected: through 1.585 |
| CVE-2014-9634 | 5.3 | Sep 12 | Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by… Affected: through 1.585 |
| CVE-2016-0790 | 5.3 | Apr 7 | Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine API tokens via a… Affected: through 1.642.1; through 1.649 |
| CVE-2019-10406 | 4.8 | Sep 25 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulting in a stored XSS vulnerability… Affected: through 2.176.3; through 2.196 |
| CVE-2019-10383 | 4.8 | Aug 28 | A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site… Affected: through 2.176.2; through 2.191 |
| CVE-2017-1000392 | 4.8 | Jan 26 | Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source… Affected: through 2.73.2; through 2.88 |
| CVE-2017-17383 | 4.7 | Dec 6 | Jenkins through 2.93 allows remote authenticated administrators to conduct XSS attacks via a crafted tool name in a job configuration form, as demonstrated by the JDK tool in… Affected: through 2.93 |
| CVE-2023-27903 | 4.4 | Mar 10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading… Affected: before 2.375.4; before 2.394 |
| CVE-2026-84656 | 4.3 | Sep 2 | A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and… Affected: through 2.568.2; through 2.579 |
| CVE-2026-84655 | 4.3 | Sep 2 | Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control… Affected: through 2.568.2; through 2.579 |
| CVE-2026-84646 | 4.3 | Sep 2 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read… Affected: before 2.568.3; before 2.580 |
| CVE-2026-70428 | 4.3 | Aug 5 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and… Affected: before 2.568.2; before 2.576 |
| CVE-2026-70427 | 4.3 | Aug 5 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives,… Affected: before 2.568.2; before 2.576 |
| CVE-2026-53440 | 4.3 | Jun 10 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after… Affected: before 2.555.3; before 2.568 |
| CVE-2026-53439 | 4.3 | Jun 10 | Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine other users' configured timezone and to… Affected: before 2.555.3; before 2.568 |
| CVE-2026-53438 | 4.3 | Jun 10 | A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read permission, to cancel queue… Affected: before 2.555.3; before 2.568 |
| CVE-2026-53437 | 4.3 | Jun 10 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline… Affected: before 2.555.3; before 2.568 |
| CVE-2026-53436 | 4.3 | Jun 10 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains relative path… Affected: before 2.555.3; before 2.568 |
| CVE-2026-27100 | 4.3 | Feb 18 | Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with… Affected: before 2.541.2; before 2.551 |
| CVE-2025-67638 | 4.3 | Dec 10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to… Affected: before 2.528.3; before 2.541 |
| CVE-2025-67637 | 4.3 | Dec 10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by… Affected: before 2.528.3; before 2.541 |
| CVE-2025-67636 | 4.3 | Dec 10 | A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views Affected: before 2.528.3; before 2.541 |
| CVE-2025-59475 | 4.3 | Sep 17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read… Affected: before 2.516.3; before 2.528 |
| CVE-2025-31721 | 4.3 | Apr 2 | A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy… Affected: before 2.492.3; before 2.504 |
| CVE-2025-31720 | 4.3 | Apr 2 | A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to… Affected: before 2.492.3; before 2.504 |
| CVE-2025-27625 | 4.3 | Mar 5 | In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attackers to perform phishing attacks by… Affected: before 2.492.2; before 2.500 |
| CVE-2025-27623 | 4.3 | Mar 5 | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowing attackers with… Affected: before 2.492.2; before 2.500 |
| CVE-2025-27622 | 4.3 | Mar 5 | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowing attackers with… Affected: before 2.492.2; before 2.500 |
| CVE-2024-47804 | 4.3 | Oct 2 | If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the… Affected: before 2.462.3; before 2.479 |
| CVE-2024-47803 | 4.3 | Oct 2 | Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `secretTextarea` form… Affected: before 2.462.3; before 2.479 |
| CVE-2023-43494 | 4.3 | Sep 20 | Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the… Affected: 2.50 before 2.424; 2.60.1 before 2.414.2 |
| CVE-2023-27902 | 4.3 | Mar 10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission to access their… Affected: before 2.375.4; before 2.394 |
| CVE-2022-20612 | 4.3 | Jan 12 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no… Affected: through 2.319.1; through 2.329 |
| CVE-2021-21682 | 4.3 | Oct 6 | Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of… Affected: through 2.303.1; through 2.314 |
| CVE-2021-21670 | 4.3 | Jun 30 | Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not… Affected: before 2.289.2; before 2.300 |
| CVE-2021-21640 | 4.3 | Apr 7 | Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create… Affected: through 2.277.1; through 2.286 |