Jenkins
Vulnerability activity for Jenkins: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 28
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 9.8CriticalJan 29, 2018Jenkins DeserializationCVE-2017-1000353Jenkins server is affected, An attacker gains remote code execution and unauthenticated access to Jenkins server, Update Jenkins to a version not vulnerable to this issue or apply the patch.Added to KEV Oct 2, 2025 · 2,802 days after publicationExploited100% likelyExploit codeExploit-DB · MetasploitDetection
- 9.8CriticalJan 24, 2024Jenkins Command Line Interface (CLI) Path traversal / file handlingCVE-2024-23897(1) Jenkins Command Line Interface (CLI) (2) Attacker gains arbitrary file access and potentially remote code execution (3) Update to Jenkins CLI to version 2.49.1 or laterAdded to KEV Aug 19, 2024 · 207 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 7.5HighNov 25, 2015Jenkins User Interface (UI) Information disclosureCVE-2015-5317Jenkins User Interface is affected. An attacker gains sensitive information about Jenkins users and jobs. Update Jenkins to version 1.596.2 or later to remediate the vulnerability.Added to KEV May 12, 2023 · 2,724 days after publicationExploited23% likely
- 9.9CriticalMar 8, 2019Jenkins Script Security PluginCVE-2019-1003029Jenkins Script Security Plugin is affected. An attacker gains arbitrary script execution and full control over the Jenkins server. Update the Jenkins Script Security Plugin to the latest version.Added to KEV Apr 25, 2022 · 1,143 days after publicationExploited74% likelyExploit codeMetasploit
- 9.9CriticalMar 8, 2019Jenkins Matrix Project Plugin Code / command injectionCVE-2019-1003030Jenkins Matrix Project Plugin is affected. An attacker gains unauthenticated remote code execution and potentially unrestricted access to the Jenkins server. Update the Jenkins Matrix Project Plugin to a fixed version (2.8.0 and later) and ensure all plugins are up to date.Added to KEV Mar 25, 2022 · 1,112 days after publicationExploited97% likelyExploit codeExploit-DB · NucleiDetection
- 9.8CriticalDec 10, 2018Jenkins Stapler Web Framework DeserializationCVE-2018-1000861Jenkins Stapler Web Framework. An attacker gains remote code execution. Update Jenkins to a version that addresses the vulnerability.Added to KEV Feb 10, 2022 · 1,157 days after publicationExploited98% likelyExploit codeMetasploit · NucleiDetection
Recent
- 4.2MediumJun 24, 2026Jenkins zowe zdevops Auth bypass / access controlCVE-2026-57307A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- 4.2MediumJun 24, 2026Jenkins zowe zdevops CSRFCVE-2026-57306A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- 5.4MediumJun 24, 2026Jenkins assembla CSRFCVE-2026-57305A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified username and password.
- 5.4MediumJun 24, 2026Jenkins assembla Auth bypass / access controlCVE-2026-57304A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password.
- 7.1HighJun 24, 2026Jenkins assembla SSRFCVE-2026-57303Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.
- 4.3MediumJun 24, 2026Jenkins fitnesseCVE-2026-57302Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system.
- 8.8HighJun 24, 2026Jenkins official owasp zapCVE-2026-57301Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
- 4.3MediumJun 24, 2026Jenkins mcp server Auth bypass / access controlCVE-2026-57300A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.
- 4.3MediumJun 24, 2026Jenkins contrast continuous application security Auth bypass / access controlCVE-2026-57299Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata.
- 4.3MediumJun 24, 2026Jenkins contrast continuous application security Auth bypass / access controlCVE-2026-57297A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key.
- 5.4MediumJun 24, 2026Jenkins ec2 fleet CSRFCVE-2026-57295A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.
- 5.4MediumJun 24, 2026Jenkins ec2 fleet Auth bypass / access controlCVE-2026-57294A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.
- 4.3MediumJun 24, 2026Jenkins priority sorter CSRFCVE-2026-57290A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration.
- 4.8MediumJun 24, 2026Jenkins bitbucket push and pull request Crypto / certificateCVE-2026-57289Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to capture the token.
- 3.7LowJun 24, 2026Jenkins active directoryCVE-2026-57288Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name.
- 4.3MediumJun 24, 2026Jenkins job configuration history Information disclosureCVE-2026-57287Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.
- 4.3MediumJun 24, 2026Jenkins git parameter Auth bypass / access controlCVE-2026-57286A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository used by a job, such as branch names, tag names, and revision metadata.
- 4.3MediumJun 24, 2026Jenkins github branch source Auth bypass / access controlCVE-2026-57285A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.
- 4.3MediumMay 27, 2026Jenkins job import Privilege escalationCVE-2026-48926Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
- 6.6MediumMay 27, 2026Jenkins ldap DeserializationCVE-2026-48917Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.
- 6.6MediumMay 27, 2026Jenkins ldap SSRFCVE-2026-48916Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.
- 4.3MediumApr 29, 2026Jenkins azure adCVE-2026-42525Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.
- 8.0HighApr 29, 2026Jenkins html publisher XSSCVE-2026-42524Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- 9.0CriticalApr 29, 2026Jenkins github XSSCVE-2026-42523Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission.
- 4.3MediumApr 29, 2026Jenkins github branch source Auth bypass / access controlCVE-2026-42522A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials.
- 6.5MediumApr 29, 2026Jenkins matrix authorization strategy DeserializationCVE-2026-42521Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.
- 7.5HighApr 29, 2026Jenkins credentials binding Path traversal / file handlingCVE-2026-42520Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.
- 4.3MediumApr 29, 2026Jenkins script security Auth bypass / access controlCVE-2026-42519A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
- 9.8CriticalJan 29, 2018Jenkins DeserializationCVE-2017-1000353Jenkins server is affected, An attacker gains remote code execution and unauthenticated access to Jenkins server, Update Jenkins to a version not vulnerable to this issue or apply the patch.Exploited100% likelyExploit codeExploit-DB · MetasploitDetection
- 9.8CriticalJan 24, 2024Jenkins Command Line Interface (CLI) Path traversal / file handlingCVE-2024-23897(1) Jenkins Command Line Interface (CLI) (2) Attacker gains arbitrary file access and potentially remote code execution (3) Update to Jenkins CLI to version 2.49.1 or laterExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 4.3MediumMay 16, 2023Jenkins email extension Privilege escalationCVE-2023-32979Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller file system.
- 7.5HighNov 25, 2015Jenkins User Interface (UI) Information disclosureCVE-2015-5317Jenkins User Interface is affected. An attacker gains sensitive information about Jenkins users and jobs. Update Jenkins to version 1.596.2 or later to remediate the vulnerability.Exploited23% likely
- 9.9CriticalMar 8, 2019Jenkins Script Security PluginCVE-2019-1003029Jenkins Script Security Plugin is affected. An attacker gains arbitrary script execution and full control over the Jenkins server. Update the Jenkins Script Security Plugin to the latest version.Exploited74% likelyExploit codeMetasploit
- 9.9CriticalMar 8, 2019Jenkins Matrix Project Plugin Code / command injectionCVE-2019-1003030Jenkins Matrix Project Plugin is affected. An attacker gains unauthenticated remote code execution and potentially unrestricted access to the Jenkins server. Update the Jenkins Matrix Project Plugin to a fixed version (2.8.0 and later) and ensure all plugins are up to date.Exploited97% likelyExploit codeExploit-DB · NucleiDetection
- 9.8CriticalDec 10, 2018Jenkins Stapler Web Framework DeserializationCVE-2018-1000861Jenkins Stapler Web Framework. An attacker gains remote code execution. Update Jenkins to a version that addresses the vulnerability.Exploited98% likelyExploit codeMetasploit · NucleiDetection
Top products
- assembla3 CVEs in the last year
- zowe zdevops2 CVEs in the last year
- ldap2 CVEs in the last year
- github branch source2 CVEs in the last year
- ec2 fleet2 CVEs in the last year
- contrast continuous application security2 CVEs in the last year
- script security1 CVE in the last year
- priority sorter1 CVE in the last year
- official owasp zap1 CVE in the last year
- mcp server1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.