Skip to contentJenkins vulnerabilities
Products
Show 140 moreShow less
Newest
- jenkins bitbucket push and pull request, jenkins project bitbucket push and pull request plugin +1 moreJenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validationCVE-2026-57289Fix available4.8 Medium
- jenkins active directory, jenkins project active directory plugin +1 moreJenkins Active Directory Plugin has an LDAP injection vulnerabilityCVE-2026-57288Fix available3.7 Low
- jenkins job configuration history, jenkins project job configuration history plugin +1 moreJenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurationsCVE-2026-57287Fix available4.3 Medium
- jenkins git parameter, jenkins project git parameter plugin +1 moreJenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag namesCVE-2026-57286Fix available4.3 Medium
- jenkins github branch source, jenkins project github branch source plugin +1 moreJenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLsCVE-2026-57285Fix available4.3 Medium
- jenkins project pipeline: groovy plugin, jenkins pipeline\ +1 moreJenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of typesCVE-2026-57284Fix available4.3 Medium
- jenkins project pipeline: groovy plugin, jenkins pipeline\ +1 moreJenkins Pipeline: Groovy Plugin has a CSRF vulnerabilityCVE-2026-57283Fix available4.3 Medium
- jenkins git client, jenkins project git client plugin +1 moreJenkins Git client Plugin has an OS command injection vulnerability on agentsCVE-2026-57282Fix available5.0 Medium
- jenkins script security, jenkins project script security plugin, red hat openshift developer tools and services +11 more +13 moreJenkins Script Security Plugin has a script security bypass vulnerabilityCVE-2026-57281Fix available7.5 High
- jenkins script security, jenkins project script security plugin +1 moreJenkins Script Security Plugin sandbox bypass vulnerabilityCVE-2026-57280Fix available8.8 High
- jenkinsJenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurationsCVE-2026-53442Fix available5.3 Medium
- jenkinsJenkins: Stored XSS vulnerability in node offline cause descriptionCVE-2026-53441Fix available5.4 Medium
- jenkinsJenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container"CVE-2026-53440Fix available4.3 Medium
- jenkinsJenkins exposes other users' timezone and view names to users with Overall/Read permissionCVE-2026-53439Fix available4.3 Medium
- jenkinsJenkins: Missing permission check allows unauthorized cancellation of queue itemsCVE-2026-53438Fix available4.3 Medium
- jenkins, red hat openshift developer tools and services 4.12, openshift developer tools and services 4.13 +9 more +11 moreJenkins Open Redirect Through Newline/Tab Characters in Redirect URLCVE-2026-53437Fix available4.3 Medium
- jenkinsJenkins Open Redirect via Relative Path Segments in Post-Login Redirect URLCVE-2026-53436Fix available4.3 Medium
- jenkins, red hat openshift developer tools and services 4.12, openshift developer tools and services 4.13 +9 more +11 moreJenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonationCVE-2026-53435Public exploitFix availableEPSS 51.2%8.8 High
- jenkins multijob, jenkins project multijob plugin +1 moreJenkins Multijob Plugin has a cross-site request forgery (CSRF) vulnerabilityCVE-2026-9674Fix available4.3 Medium
- jenkins buildgraph-view, jenkins project buildgraph-view plugin +1 moreJenkins buildgraph-view Plugin does not escape the build URLCVE-2026-489275.5 Medium
- jenkins job import, jenkins project job import plugin +1 moreJenkins Job Import Plugin does not perform a permission check in an HTTP endpointCVE-2026-48926Fix available4.3 Medium
- jenkins bitbucket oauth, jenkins project bitbucket oauth plugin +1 moreJenkins Bitbucket OAuth Plugin does not restrict the redirect URL after loginCVE-2026-48924Fix available4.3 Medium
- jenkins appspider, jenkins project appspider plugin +1 moreJenkins AppSpider Plugin does not perform a permission check in a method implementing form validationCVE-2026-48923Fix available4.3 Medium
- jenkins credentials binding, jenkins project credentials binding plugin +1 moreJenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentialsCVE-2026-48922Fix available7.5 High
- jenkins project pipeline: groovy libraries plugin, jenkins pipeline\ +1 moreJenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared librariesCVE-2026-48921Fix available7.5 High
- jenkins email extension, jenkins project email extension plugin +1 moreJenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystemCVE-2026-48920Fix available8.8 High
- jenkins active directory, jenkins project active directory plugin +1 moreJenkins Active Directory Plugin deserializes data from LDAP referrals without validationCVE-2026-48919Fix available6.6 Medium
- jenkins active directory, jenkins project active directory plugin +1 moreJenkins Active Directory Plugin follows LDAP referrals by defaultCVE-2026-48918Fix available6.6 Medium
- jenkins ldap, jenkins project ldap plugin +1 moreJenkins LDAP Plugin deserializes data from LDAP referrals without validationCVE-2026-48917Fix available6.6 Medium
- jenkins ldap, jenkins project ldap plugin +1 moreJenkins LDAP Plugin follows LDAP referralsCVE-2026-48916Fix available6.6 Medium
- jenkins azure ad, jenkins project microsoft entra id (previously azure ad) plugin +1 moreJenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect vulnerabilityCVE-2026-42525Fix available4.3 Medium
- jenkins html publisher, jenkins project html publisher plugin +1 moreJenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper fileCVE-2026-42524Fix available8.0 High
- jenkins github, jenkins project github plugin +1 moreJenkins GitHub Plugin has an XSS vulnerabilityCVE-2026-42523Fix available9.0 Critical
- jenkins github branch source, jenkins project github branch source plugin +1 moreJenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection testCVE-2026-42522Fix available4.3 Medium
- jenkins matrix authorization strategy, jenkins project matrix authorization strategy plugin +1 moreJenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructorsCVE-2026-42521Fix available6.5 Medium
- jenkins credentials binding, jenkins project credentials binding plugin +1 moreJenkins Credentials Binding Plugin has a path traversal vulnerabilityCVE-2026-42520Fix available7.5 High
- jenkins script security, jenkins project script security plugin +1 moreJenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpathsCVE-2026-42519Fix available4.3 Medium
- jenkins loadninja, jenkins project loadninja plugin +1 moreJenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration formCVE-2026-33004Fix available4.3 Medium
- jenkins loadninja, jenkins project loadninja plugin +1 moreJenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml filesCVE-2026-33003Fix available4.3 Medium
- jenkinsJenkins has a DNS rebinding vulnerability in WebSocket CLI origin validationCVE-2026-33002Fix available7.5 High
- jenkins, red hat openshift developer tools and services 4.12, openshift developer tools and services 4.13 +9 more +11 moreJenkins has a link following vulnerability allows arbitrary file creationCVE-2026-33001Fix available8.8 High
- jenkinsJenkins has a build information disclosure vulnerability through Run ParameterCVE-2026-27100Fix available4.3 Medium
- jenkinsJenkins has a stored XSS vulnerability in node offline cause descriptionCVE-2026-27099Fix available8.0 High
- jenkins redpen - pipeline reporter for jira, jenkins project redpen - pipeline reporter for jira plugin +1 moreJenkins Redpen - Pipeline Reporter for Jira Plugin has a path traversal vulnerabilityCVE-2025-676434.3 Medium
- jenkins hashicorp vault, jenkins project hashicorp vault plugin +1 moreJenkins HashiCorp Vault Plugin exposes system-scoped Vault credentialsCVE-2025-676424.3 Medium
- jenkins coverage, jenkins project coverage plugin +1 moreJenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerabilityCVE-2025-67641Fix available5.4 Medium
- jenkins git client, jenkins project git client plugin +1 moreJenkins Git client Plugin has an OS command injection vulnerability on agents in Git client PluginCVE-2025-67640Fix available5.0 Medium
- jenkinsJenkins has a CSRF vulnerability on the login formCVE-2025-67639Fix available3.5 Low
- jenkinsJenkins's build authorization token is stored and displayed in plain textCVE-2025-67638Fix available4.3 Medium
- jenkinsJenkins's build authorization token is stored and displayed in plain textCVE-2025-67637Fix available4.3 Medium
- Show moreLoading…