Login Request a demo
JE
Vendor
Jenkins
702 products with CVEs on record
1,831
CVEs
8
On KEV
0
New 30D
Products
JE
Jenkins
DevOps
9.9
286 CVEs6 on KEV0 new
SS
Script Security
Jenkins
9.9
45 CVEs1 on KEV0 new
PG
Pipeline: Groovy
Jenkins
9.9
14 CVEs1 on KEV0 new
AD
Active Directory
Jenkins
9.8
12 CVEs0 on KEV0 new
BO
Blue Ocean
Jenkins
8.8
11 CVEs0 on KEV0 new
EE
Email Extension
Jenkins
9.9
11 CVEs0 on KEV0 new
GI
Git
Jenkins
8.8
11 CVEs0 on KEV0 new
BF
Build Failure Analyzer
Jenkins
8.8
9 CVEs0 on KEV0 new
CF
Config File Provider
Jenkins
8.1
9 CVEs0 on KEV0 new
CA
Configuration AS Code
Jenkins
8.8
9 CVEs0 on KEV0 new
CB
Credentials Binding
Jenkins
7.5
8 CVEs0 on KEV0 new
GB
Github Branch Source
Jenkins
6.5
8 CVEs0 on KEV0 new
NI
Ns-nd Integration Performance Publisher
Jenkins
8.8
8 CVEs0 on KEV0 new
PG
Pipeline:shared Groovy Libraries
Jenkins
8.8
8 CVEs0 on KEV0 new
HP
Html Publisher
Jenkins
8.0
7 CVEs0 on KEV0 new
JC
Job Configuration History
Jenkins
8.8
7 CVEs0 on KEV0 new
KU
Kubernetes
Jenkins
8.8
7 CVEs0 on KEV0 new
OC
Openid Connect Authentication
Jenkins
8.8
7 CVEs0 on KEV0 new
OD
Openshift Deployer
Jenkins
6.5
7 CVEs0 on KEV0 new
RU
Rundeck
Jenkins
8.8
7 CVEs0 on KEV0 new
SS
Saml Single Sign ON
Jenkins
8.8
7 CVEs0 on KEV0 new
SU
Subversion
Jenkins
7.5
7 CVEs0 on KEV0 new
AE
Amazon Ec2
Jenkins
8.8
6 CVEs0 on KEV0 new
AA
Azure AD
Jenkins
8.8
6 CVEs0 on KEV0 new
AV
Azure VM Agents
Jenkins
8.8
6 CVEs0 on KEV0 new
DD
Deployment Dashboard
Jenkins
5.4
6 CVEs0 on KEV0 new
EL
Electricflow
Jenkins
6.5
6 CVEs0 on KEV0 new
GT
Gerrit Trigger
Jenkins
8.8
6 CVEs0 on KEV0 new
GC
Git Client
Jenkins
8.8
6 CVEs0 on KEV0 new
GP
Git Parameter
Jenkins
8.2
6 CVEs0 on KEV0 new
GI
Github
Jenkins
9.0
6 CVEs0 on KEV0 new
GP
Github Pull Request Builder
Jenkins
8.8
6 CVEs0 on KEV0 new
GI
Gitlab
Jenkins
8.8
6 CVEs0 on KEV0 new
GC
Google Compute Engine
Jenkins
8.8
6 CVEs0 on KEV0 new
HV
Hashicorp Vault
Jenkins
7.5
6 CVEs0 on KEV0 new
OP
Openid
Jenkins
9.8
6 CVEs0 on KEV0 new
PM
Pipeline Maven Integration
Jenkins
8.1
6 CVEs0 on KEV0 new
PI
Project Inheritance
Jenkins
6.5
6 CVEs0 on KEV0 new
RC
Repository Connector
Jenkins
7.8
6 CVEs0 on KEV0 new
WN
Warnings Next Generation
Jenkins
8.8
6 CVEs0 on KEV0 new
XX
Xebialabs XL Deploy
Jenkins
8.8
6 CVEs0 on KEV0 new
AC
Active Choices
Jenkins
5.4
5 CVEs0 on KEV0 new
AP
Appspider
Jenkins
8.8
5 CVEs0 on KEV0 new
AS
Assembla
Jenkins
8.8
5 CVEs0 on KEV0 new
AC
Aws Codecommit Trigger
Jenkins
6.5
5 CVEs0 on KEV0 new
CV
Cadence Vmanager
Jenkins
8.2
5 CVEs0 on KEV0 new
CS
Chef Sinatra
Jenkins
8.8
5 CVEs0 on KEV0 new
CD
Code DX
Jenkins
4.3
5 CVEs0 on KEV0 new
DE
Delphix
Jenkins
7.8
5 CVEs0 on KEV0 new
EC
Extended Choice Parameter
Jenkins
8.8
5 CVEs0 on KEV0 new
FO
Fortify
Jenkins
6.1
5 CVEs0 on KEV0 new
GL
Google Login
Jenkins
7.5
5 CVEs0 on KEV0 new
JI
Jira
Jenkins
9.9
5 CVEs0 on KEV0 new
JA
Job And Node Ownership
Jenkins
8.8
5 CVEs0 on KEV0 new
JI
Job Import
Jenkins
9.1
5 CVEs0 on KEV0 new
JU
Junit
Jenkins
8.3
5 CVEs0 on KEV0 new
MA
Mabl
Jenkins
8.8
5 CVEs0 on KEV0 new
MA
Mailer
Jenkins
8.0
5 CVEs0 on KEV0 new
MP
Matrix Project
Jenkins
9.9
5 CVEs0 on KEV0 new
ME
Mercurial
Jenkins
7.5
5 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-92129
SS
Script Security
Jenkins
7.5
0%
Sep 16Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers…
CVE-2026-92128
SS
Script Security
Jenkins
7.5
0%
Sep 16Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the…
CVE-2026-92127
SS
Script Security
Jenkins
8.0
1%
Sep 16Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer…
CVE-2026-92126
SS
Script Security
Jenkins
8.5
1%
Sep 16Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers…
CVE-2026-92125
SS
Script Security
Jenkins
8.8
1%
Sep 16Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run…
CVE-2026-92124
SS
Script Security
Jenkins
8.8
1%
Sep 16Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script…
CVE-2026-92123
SS
Script Security
Jenkins
8.8
1%
Sep 16Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribute accesses, and…
CVE-2026-92122
SS
Script Security
Jenkins
8.8
1%
Sep 16Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an…
CVE-2026-84659
SS
Script Security
Jenkins
4.3
0%
Sep 2Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the…
CVE-2026-84658
SS
Script Security
Jenkins
4.3
0%
Sep 2Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing…
CVE-2026-84657
JE
Jenkins
Jenkins
4.2
0%
Sep 2In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait…
CVE-2026-84656
JE
Jenkins
Jenkins
4.3
0%
Sep 2A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and…
CVE-2026-84655
JE
Jenkins
Jenkins
4.3
0%
Sep 2Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control…
CVE-2026-84654
JE
Jenkins
Jenkins
5.4
0%
Sep 2In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting…
CVE-2026-84653
JE
Jenkins
Jenkins
3.5
0%
Sep 2Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page,…
CVE-2026-84652
JE
Jenkins
Jenkins
7.3
0%
Sep 2In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to…
CVE-2026-84651
JE
Jenkins
Jenkins
6.3
0%
Sep 2In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a…
CVE-2026-84650
JE
Jenkins
Jenkins
8.8
0%
Sep 2In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify…
CVE-2026-84649
JE
Jenkins
Jenkins
8.8
0%
Sep 2In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS…
CVE-2026-84648
JE
Jenkins
Jenkins
8.8
1%
Sep 2In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site…
CVE-2026-84647
JE
Jenkins
Jenkins
8.8
1%
Sep 2In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of…
CVE-2026-84646
JE
Jenkins
Jenkins
4.3
0%
Sep 2In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read…
CVE-2026-84645
JE
Jenkins
Jenkins
8.8
1%
Sep 2In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the…
CVE-2026-70430
JE
Jenkins
Jenkins
2.7
0%
Aug 5Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing…
CVE-2026-70429
JE
Jenkins
Jenkins
6.5
0%
Aug 5Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups…
CVE-2026-70428
JE
Jenkins
Jenkins
4.3
0%
Aug 5Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and…
CVE-2026-70427
JE
Jenkins
Jenkins
4.3
0%
Aug 5Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives,…
CVE-2026-70426
JE
Jenkins
Jenkins
9.0
1%
Aug 5In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied…
CVE-2026-57307
ZZ
Zowe Zdevops
Jenkins
4.2
0%
Jun 24A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified…
CVE-2026-57306
ZZ
Zowe Zdevops
Jenkins
4.2
0%
Jun 24A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL…
CVE-2026-57305
AS
Assembla
Jenkins
5.4
0%
Jun 24A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified…
CVE-2026-57304
AS
Assembla
Jenkins
5.4
0%
Jun 24A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an…
CVE-2026-57303
AS
Assembla
Jenkins
7.1
0%
Jun 24Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the…
CVE-2026-57302
FI
Fitnesse
Jenkins
4.3
0%
Jun 24Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read…
CVE-2026-57301
OO
Official Owasp Zap
Jenkins
8.8
1%
Jun 24Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to…
CVE-2026-57300
MS
Mcp Server
Jenkins
4.3
0%
Jun 24A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs…
CVE-2026-57299
CC
Contrast Continuous Application Security
Jenkins
4.3
0%
Jun 24Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of…
CVE-2026-57297
CC
Contrast Continuous Application Security
Jenkins
4.3
0%
Jun 24A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an…
CVE-2026-57295
EF
Ec2 Fleet
Jenkins
5.4
0%
Jun 24A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-specified URL using…
CVE-2026-57294
EF
Ec2 Fleet
Jenkins
5.4
0%
Jun 24A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL…
CVE-2026-57290
PS
Priority Sorter
Jenkins
4.3
0%
Jun 24A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority…
CVE-2026-57289
BP
Bitbucket Push And Pull Request
Jenkins
4.8
0%
Jun 24Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token…
CVE-2026-57288
AD
Active Directory
Jenkins
3.7
0%
Jun 24Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing…
CVE-2026-57287
JC
Job Configuration History
Jenkins
4.3
0%
Jun 24Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations,…
CVE-2026-57286
GP
Git Parameter
Jenkins
4.3
0%
Jun 24A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository…
CVE-2026-57285
GB
Github Branch Source
Jenkins
4.3
0%
Jun 24A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub…
CVE-2026-57284
PG
Pipeline: Groovy
Jenkins
4.3
0%
Jun 24Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to…
CVE-2026-57283
PG
Pipeline: Groovy
Jenkins
4.3
0%
Jun 24A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types related to job or system…
CVE-2026-57282
GC
Git Client
Jenkins
5.0
0%
Jun 24Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH wrapper script, allowing attackers able…
CVE-2026-57281
SS
Script Security
Jenkins
7.5
1%
Jun 24Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run…
CVE-2026-57280
SS
Script Security
Jenkins
8.8
1%
Jun 24Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy…
CVE-2026-53442
JE
Jenkins
Jenkins
5.3
0%
Jun 10Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job…
CVE-2026-53441
JE
Jenkins
Jenkins
5.4
0%
Jun 10Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be…
CVE-2026-53440
JE
Jenkins
Jenkins
4.3
0%
Jun 10Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after…
CVE-2026-53439
JE
Jenkins
Jenkins
4.3
0%
Jun 10Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine other users' configured timezone and to…
CVE-2026-53438
JE
Jenkins
Jenkins
4.3
0%
Jun 10A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read permission, to cancel queue…
CVE-2026-53437
JE
Jenkins
Jenkins
4.3
0%
Jun 10Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline…
CVE-2026-53436
JE
Jenkins
Jenkins
4.3
0%
Jun 10Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains relative path…
CVE-2026-53435
JE
Jenkins
Jenkins
8.8
53%
Jun 10In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an…
CVE-2026-9674
MU
Multijob
Jenkins
4.3
0%
May 27A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failed Multijob builds