Jenkins - vulnerabilities (CVEs)

1830 CVEs in 712 products, 0 in the last 30 days, newest from 2026-09-16.

Products

Jenkins - 282 CVEs
Script Security - 45 CVEs
Pipeline\ - 40 CVEs
Active Directory - 12 CVEs
Blue Ocean - 11 CVEs
Email Extension - 11 CVEs
Git - 11 CVEs
Build Failure Analyzer - 9 CVEs
Config File Provider - 9 CVEs
Configuration As Code - 9 CVEs
Credentials Binding - 8 CVEs
Github Branch Source - 8 CVEs
Ns-nd Integration Performance Publisher - 8 CVEs
Html Publisher - 7 CVEs
Job Configuration History - 7 CVEs
Kubernetes - 7 CVEs
Openid - 7 CVEs
Openid Connect Authentication - 7 CVEs
Openshift Deployer - 7 CVEs
Rundeck - 7 CVEs
Subversion - 7 CVEs
Amazon Ec2 - 6 CVEs
Azure Ad - 6 CVEs
Azure Vm Agents - 6 CVEs
Deployment Dashboard - 6 CVEs
Electricflow - 6 CVEs
Gerrit Trigger - 6 CVEs
Git Client - 6 CVEs
Git Parameter - 6 CVEs
Github - 6 CVEs
Github Pull Request Builder - 6 CVEs
Gitlab - 6 CVEs
Google Compute Engine - 6 CVEs
Hashicorp Vault - 6 CVEs
Pipeline Maven Integration - 6 CVEs
Project Inheritance - 6 CVEs
Repository Connector - 6 CVEs
Saml Single Sign On - 6 CVEs
Warnings Next Generation - 6 CVEs
Xebialabs Xl Deploy - 6 CVEs
Active Choices - 5 CVEs
Appspider - 5 CVEs
Assembla - 5 CVEs
Aws Codecommit Trigger - 5 CVEs
Cadence Vmanager - 5 CVEs
Cas - 5 CVEs
Chef Sinatra - 5 CVEs
Code Dx - 5 CVEs
Credentials - 5 CVEs
Delphix - 5 CVEs
Extended Choice Parameter - 5 CVEs
Fortify - 5 CVEs
Google Login - 5 CVEs
Jenkins Code Dx Plugin - 5 CVEs
Jira - 5 CVEs
Job And Node Ownership - 5 CVEs
Job Import - 5 CVEs
Junit - 5 CVEs
Mabl - 5 CVEs
Mailer - 5 CVEs
Matrix Project - 5 CVEs
Mercurial - 5 CVEs
Neuvector Vulnerability Scanner - 5 CVEs
Octoperf Load Testing - 5 CVEs
Promoted Builds - 5 CVEs
Publish Over Ssh - 5 CVEs
Scriptler - 5 CVEs
Support Core - 5 CVEs
Websphere Deployer - 5 CVEs
Wso2 Oauth - 5 CVEs
Ansible - 4 CVEs
Bitbucket Branch Source - 4 CVEs
Bitbucket Oauth - 4 CVEs
Build-publisher - 4 CVEs
Checkmarx - 4 CVEs
Compuware Topaz For Total Test - 4 CVEs
Cons3rt - 4 CVEs
Continuous Integration With Toad Edge - 4 CVEs
Convertigo Mobile Platform - 4 CVEs
Coverity - 4 CVEs
Crx Content Package Deployer - 4 CVEs
Deployer Framework - 4 CVEs
Docker - 4 CVEs
Embeddable Build Status - 4 CVEs
Fortify On Demand - 4 CVEs
Gitlab Authentication - 4 CVEs
Gogs - 4 CVEs
Health Advisor By Cloudbees - 4 CVEs
Icescrum - 4 CVEs
Jira Pipeline Steps - 4 CVEs
Katalon - 4 CVEs
Kubernetes Ci - 4 CVEs
Kubernetes Continuous Deploy - 4 CVEs
Liquibase Runner - 4 CVEs
Matlab - 4 CVEs
Maven - 4 CVEs
Nexus Platform - 4 CVEs
Orka By Macstadium - 4 CVEs
P4 - 4 CVEs
Paaslane Estimate - 4 CVEs
Proxmox - 4 CVEs
Rapiddeploy - 4 CVEs
Report Portal - 4 CVEs
Requests - 4 CVEs
Role-based Authorization Strategy - 4 CVEs
S3 Publisher - 4 CVEs
Ssh - 4 CVEs
Static Analysis Utilities - 4 CVEs
Subversion Partial Release Manager - 4 CVEs
Team Concert - 4 CVEs
Team Foundation Server - 4 CVEs
Vmware Lab Manager Slaves - 4 CVEs
Warnings - 4 CVEs
Ansible Tower - 3 CVEs
Applitools Eyes - 3 CVEs
Aqua Security Scanner - 3 CVEs
Audit To Database - 3 CVEs
Audit Trail - 3 CVEs
Autocomplete Parameter - 3 CVEs
Azure Credentials - 3 CVEs
Beaker Builder - 3 CVEs
Bitbucket Server Integration - 3 CVEs
Black Duck Hub - 3 CVEs
Build-metrics - 3 CVEs
Cloudbees Aws Credentials - 3 CVEs
Cloudbees Cd - 3 CVEs
Code Coverage Api - 3 CVEs
Conjur Secrets - 3 CVEs
Contrast Continuous Application Security - 3 CVEs
Dashboard View - 3 CVEs
Database - 3 CVEs
Dbcharts - 3 CVEs
Dotci - 3 CVEs
Dynamic Extended Choice Parameter - 3 CVEs
Dynatrace Application Monitoring - 3 CVEs
Easyqa - 3 CVEs
Elastest - 3 CVEs
Elasticbox Ci - 3 CVEs
Fitnesse - 3 CVEs
Flaky Test Handler - 3 CVEs
Folders - 3 CVEs
Ftp Publisher - 3 CVEs
Generic Webhook Trigger - 3 CVEs
Groovy - 3 CVEs
Kmap - 3 CVEs
Libvirt Slaves - 3 CVEs
Lucene-search - 3 CVEs
Mac - 3 CVEs
Matrix Authorization Strategy - 3 CVEs
Netsparker Cloud Scan - 3 CVEs
Nomad - 3 CVEs
Openstack Heat - 3 CVEs
Owasp Dependency-check - 3 CVEs
Pipeline Github Notify Step - 3 CVEs
Publish To Bitbucket - 3 CVEs
Recipe - 3 CVEs
Relution Enterprise Appstore Publisher - 3 CVEs
Reverse Proxy Auth - 3 CVEs
Rocketchat Notifier - 3 CVEs
Rqm - 3 CVEs
Saml - 3 CVEs
Self-organizing Swarm Modules - 3 CVEs
Semantic Versioning - 3 CVEs
Soasta Cloudtest - 3 CVEs
Storable Configs - 3 CVEs
Synopsys Coverity - 3 CVEs
Testcomplete Support - 3 CVEs
Testlink - 3 CVEs
Testquality Updater - 3 CVEs
Tracetronic Ecu-test - 3 CVEs
Vsphere - 3 CVEs
Xebialabs Xl Release - 3 CVEs
Xpath Configuration Viewer - 3 CVEs
Zephyr Enterprise Test Management - 3 CVEs
Zephyr For Jira Test Management - 3 CVEs
360 Fireline - 2 CVEs
Agent Server Parameter - 2 CVEs
Alauda Devops Pipeline - 2 CVEs
Alauda Kubernetes Support - 2 CVEs
Anchore Container Image Scanner - 2 CVEs
Android Lint - 2 CVEs
Apica Loadtest - 2 CVEs
Aqua Microscanner - 2 CVEs
Asakusasatellite - 2 CVEs
Assembla Auth - 2 CVEs
Autonomiq - 2 CVEs
Aws Codedeploy - 2 CVEs
Azure Key Vault - 2 CVEs
Azure Service Fabric - 2 CVEs
Badge - 2 CVEs
Bearychat - 2 CVEs
Benchmark Evaluator - 2 CVEs
Bigpanda Notifier - 2 CVEs
Bitbucket Push And Pull Request - 2 CVEs
Build Notifications - 2 CVEs
Build With Parameters - 2 CVEs
Buildgraph-view - 2 CVEs
Bumblebee Hp Alm - 2 CVEs
Byteguard Build Actions - 2 CVEs
Cisco Spark - 2 CVEs
Claim - 2 CVEs
Cloudbees - 2 CVEs
Cluster Statistics - 2 CVEs
Cobertura - 2 CVEs
Collabnet - 2 CVEs
Compuware Ispw Operations - 2 CVEs
Compuware Source Code Download For Endevor, Pds, And Ispw - 2 CVEs
Compuware Topaz Utilities - 2 CVEs
Compuware Xpediter Code Coverage - 2 CVEs
Consul Kv Builder - 2 CVEs
Convert To Pipeline - 2 CVEs
Coverage/complexity Scatter Plot - 2 CVEs
Curseforge Publisher - 2 CVEs
Custom Checkbox Parameter - 2 CVEs
Cvs - 2 CVEs
Datadog - 2 CVEs
Dead Man's Snitch - 2 CVEs
Debian Package Builder - 2 CVEs
Delete Log - 2 CVEs
Dependency Graph Viewer - 2 CVEs
Deploy Weblogic - 2 CVEs
Deployhub - 2 CVEs
Digital.ai App Management Publisher - 2 CVEs
Dingding Json Pusher - 2 CVEs
Docker-build-step - 2 CVEs
Docker Commons - 2 CVEs
Dry - 2 CVEs
Ec2 - 2 CVEs
Ec2 Fleet - 2 CVEs
Echarts Api - 2 CVEs
External Monitor Job Type - 2 CVEs
Extra Columns - 2 CVEs
Failed Job Deactivator - 2 CVEs
Favorite - 2 CVEs
Filesystem List Parameter - 2 CVEs
Findbugs - 2 CVEs
Folder-based Authorization Strategy - 2 CVEs
Fortify On Demand Uploader - 2 CVEs
Frugal Testing - 2 CVEs
Gatling - 2 CVEs
Gearman - 2 CVEs
Git Changelog - 2 CVEs
Git Server - 2 CVEs
Gitbucket - 2 CVEs
Github Oauth - 2 CVEs
Gitlab Hook - 2 CVEs
Gitlab Oauth - 2 CVEs
Global-build-stats - 2 CVEs
Google Cloud Backup - 2 CVEs
Google Kubernetes Engine - 2 CVEs
Groovy Libraries - 2 CVEs
Harvest Scm - 2 CVEs
Image Tag Parameter - 2 CVEs
Inedo Buildmaster - 2 CVEs
Inedo Proget - 2 CVEs
Jclouds - 2 CVEs
Jenkins-reviewbot - 2 CVEs
Jianliao Notification - 2 CVEs
Jiratestresultreporter - 2 CVEs
Jx Resources - 2 CVEs
Keycloak Authentication - 2 CVEs
Koji - 2 CVEs
Kubernetes Pipeline - 2 CVEs
Lambdatest-automation - 2 CVEs
Ldap - 2 CVEs
Loadninja - 2 CVEs
Lockable Resources - 2 CVEs
M2release - 2 CVEs
Mashup Portlets - 2 CVEs
Mask Passwords - 2 CVEs
Matrix Reloaded - 2 CVEs
Mattermost - 2 CVEs
Maven Artifact Choicelistprovider (nexus) - 2 CVEs
Maven Metadata - 2 CVEs
Maven Repository Server - 2 CVEs
Mcp Server - 2 CVEs
Mongodb - 2 CVEs
Multijob - 2 CVEs
Nested View - 2 CVEs
Nexus Task Runner - 2 CVEs
Nouvola Divecloud - 2 CVEs
Nunit - 2 CVEs
Octopusdeploy - 2 CVEs
Official Owasp Zap - 2 CVEs
Ontrack - 2 CVEs
Openshift Login - 2 CVEs
Openshift Pipeline - 2 CVEs
Opsgenie - 2 CVEs
Oracle Cloud Infrastructure Compute Classic - 2 CVEs
Owasp Dependency-track - 2 CVEs
Parameterized Trigger - 2 CVEs
Perfecto - 2 CVEs
Performance - 2 CVEs
Pipeline Aggregator View - 2 CVEs
Pipeline Utility Steps - 2 CVEs
Plot - 2 CVEs
Publish Over Ftp - 2 CVEs
Qmetry Test Management - 2 CVEs
Quay.io Trigger - 2 CVEs
Rabbitmq Consumer - 2 CVEs
Readyapi Functional Testing - 2 CVEs
Redgate Sql Change Automation - 2 CVEs
Release - 2 CVEs
Release Helper - 2 CVEs
Repo - 2 CVEs
Request Rename Or Delete - 2 CVEs
Rest List Parameter - 2 CVEs
Scm Httpclient - 2 CVEs
Scp Publisher - 2 CVEs
Selection Tasks - 2 CVEs
Sensedia Api Platform Tools - 2 CVEs
Servicenow Devops - 2 CVEs
Shelve Project - 2 CVEs
Sidebar Link - 2 CVEs
Simple Queue - 2 CVEs
Sitemonitor - 2 CVEs
Skytap Cloud Ci - 2 CVEs
Slack Notification - 2 CVEs
Snow Commander - 2 CVEs
Soapui Pro Functional Testing - 2 CVEs
Sonar Gerrit - 2 CVEs
Sonargraph Integration - 2 CVEs
Sounds - 2 CVEs
Spira Importer - 2 CVEs
Squash Tm Publisher - 2 CVEs
Ssh Agent - 2 CVEs
Start Windocks Container - 2 CVEs
Stash Branch Parameter - 2 CVEs
Statistics Gatherer - 2 CVEs
Sumologic Publisher - 2 CVEs
Swamp - 2 CVEs
Tag Profiler - 2 CVEs
Tap - 2 CVEs
Templating Engine - 2 CVEs
Test Results Aggregator - 2 CVEs
Testng Results - 2 CVEs
Tests Selector - 2 CVEs
Themis - 2 CVEs
Threadfix - 2 CVEs
Token Macro - 2 CVEs
Urltrigger - 2 CVEs
Vaddy - 2 CVEs
Valgrind - 2 CVEs
View26 Test-reporting - 2 CVEs
Violation Comments To Gitlab - 2 CVEs
Vncrecorder - 2 CVEs
Vrealize Orchestrator - 2 CVEs
Wildfly Deployer - 2 CVEs
Wmi Windows Agents - 2 CVEs
Worksoft Execution Manager - 2 CVEs
Xl Testview - 2 CVEs
Xooa - 2 CVEs
Xray - Test Management For Jira - 2 CVEs
Zowe Zdevops - 2 CVEs
Absint A3 - 1 CVEs
Absint Astree - 1 CVEs
Accurev - 1 CVEs
Amazon Sns Build Notifier - 1 CVEs
Amazon Web Services Serverless Application Model - 1 CVEs
Anchorchain - 1 CVEs
Android Signing - 1 CVEs
Appdynamics - 1 CVEs
Applatix - 1 CVEs
Application Detector - 1 CVEs
Apprenda - 1 CVEs
Aqua Security Severless Scanner - 1 CVEs
Artifact Repository Parameter - 1 CVEs
Assembla Merge Request Builder - 1 CVEs
Associated Files - 1 CVEs
Authorize Project - 1 CVEs
Avatar - 1 CVEs
Aws-device-farm - 1 CVEs
Aws Cloudwatch Logs Publisher - 1 CVEs
Aws Codebuild - 1 CVEs
Aws Codepipeline - 1 CVEs
Aws Elastic Beanstalk Publisher - 1 CVEs
Aws Global Configuration - 1 CVEs
Awseb Deployment - 1 CVEs
Azure Cli - 1 CVEs
Azure Container Service - 1 CVEs
Azure Event Grid Notifier - 1 CVEs
Azure Publishersettings Credentials - 1 CVEs
Backlog - 1 CVEs
Bart - 1 CVEs
Batch Task - 1 CVEs
Bazaar - 1 CVEs
Bitbucket Approve - 1 CVEs
Blazemeter Plugin - 1 CVEs
Bmc Release Package And Deployment - 1 CVEs
Brakeman - 1 CVEs
Buckminster - 1 CVEs
Bugzilla - 1 CVEs
Build Environment - 1 CVEs
Build Monitor View - 1 CVEs
Build Pipeline - 1 CVEs
Caliper Ci - 1 CVEs
Call Remote Job - 1 CVEs
Cccc - 1 CVEs
Ccm - 1 CVEs
Checkstyle - 1 CVEs
Chef Identity - 1 CVEs
Chosen-views-tabbar - 1 CVEs
Clearcase Release - 1 CVEs
Clif Performance Testing - 1 CVEs
Cloud Foundry - 1 CVEs
Cloud Infrastructure Compute - 1 CVEs
Cloud Statistics - 1 CVEs
Cloudbees Docker Hub/registry Notification - 1 CVEs
Cloudcoreo Deploytime - 1 CVEs
Cloudshare Docker-machine - 1 CVEs
Codefresh Integration - 1 CVEs
Codescan - 1 CVEs
Compact Columns - 1 CVEs
Computer Queue - 1 CVEs
Compuware Common Configuration - 1 CVEs
Compuware Strobe Measurement - 1 CVEs
Compuware Zadviser Api - 1 CVEs
Config Rotator - 1 CVEs
Configuration Slicing - 1 CVEs
Confluence Publisher - 1 CVEs
Copr - 1 CVEs
Copy Artifact - 1 CVEs
Copy Data To Workspace - 1 CVEs
Copy To Slave - 1 CVEs
Couchdb-statistics - 1 CVEs
Coverage - 1 CVEs
Cppcheck - 1 CVEs
Cppncss - 1 CVEs
Crap4j - 1 CVEs
Crittercism-dsym - 1 CVEs
Crowd Integration - 1 CVEs
Cryptomove - 1 CVEs
Cucumber Living Documentation - 1 CVEs
Current Versions Systems - 1 CVEs
Custom Build Properties - 1 CVEs
Custom Job Icon - 1 CVEs
Data Theorem Mobile App Security - 1 CVEs
Date Parameter - 1 CVEs
Delivery Pipeline - 1 CVEs
Deploy - 1 CVEs
Description Column - 1 CVEs
Diawi Upload - 1 CVEs
Digitalocean - 1 CVEs
Dingding - 1 CVEs
Dingtalk - 1 CVEs
Distributed Fork - 1 CVEs
Docker Swarm - 1 CVEs
Doktor - 1 CVEs
Eagle Tester - 1 CVEs
Ecx Copy Data Management - 1 CVEs
Edgewall Trac - 1 CVEs
Eggplant - 1 CVEs
Eggplant Runner - 1 CVEs
Eiffel Broadcaster - 1 CVEs
Elasticsearch Query - 1 CVEs
Eloyente - 1 CVEs
Email Extension Template - 1 CVEs
Environment Dashboard - 1 CVEs
Extensible Choice Parameter - 1 CVEs
Extensive Testing - 1 CVEs
Extreme-feedback - 1 CVEs
Extreme Feedback Panel - 1 CVEs
Fabric Beta Publisher - 1 CVEs
Favorite Plugin - 1 CVEs
Favorite View - 1 CVEs
File Parameters - 1 CVEs
File System Scm - 1 CVEs
Files Found Trigger - 1 CVEs
Filesystem Trigger - 1 CVEs
Fogbugz - 1 CVEs
Fortify Cloudscan - 1 CVEs
Gem Publisher - 1 CVEs
Github Authentication - 1 CVEs
Github Coverage Reporter - 1 CVEs
Github Pull Request Coverage Status - 1 CVEs
Gitlab Logo - 1 CVEs
Global Build Stats - 1 CVEs
Global Post Script - 1 CVEs
Global Variable String Parameter - 1 CVEs
Google-play-android-publisher - 1 CVEs
Google Calendar - 1 CVEs
Google Oauth Credentials - 1 CVEs
Gradle - 1 CVEs
Groovy Postbuild - 1 CVEs
Hidden Parameter - 1 CVEs
Hockeyapp - 1 CVEs
Hpe Network Virtualization - 1 CVEs
Html Resource - 1 CVEs
Http Request - 1 CVEs
Hyper.sh Commons - 1 CVEs
Ibm Application Security On Cloud - 1 CVEs
Ibm Cloud Devops - 1 CVEs
Ifttt Build Notifier - 1 CVEs
Image Gallery - 1 CVEs
Implied Labels - 1 CVEs
Incapptic Connect Uploader - 1 CVEs
Installation Manager Tool - 1 CVEs
Instant-messaging - 1 CVEs
Irc - 1 CVEs
Ivy - 1 CVEs

Newest CVEs of Jenkins

CVE-2026-92129 - CVSS 7.5 (high), 2026-09-16: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at…
CVE-2026-92128 - CVSS 7.5 (high), 2026-09-16: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download…
CVE-2026-92127 - CVSS 8 (high), 2026-09-16: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with…
CVE-2026-92126 - CVSS 8.5 (high), 2026-09-16: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class,…
CVE-2026-92125 - CVSS 8.8 (high), 2026-09-16: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with…
CVE-2026-92124 - CVSS 8.8 (high), 2026-09-16: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a…
CVE-2026-92123 - CVSS 8.8 (high), 2026-09-16: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and…
CVE-2026-92122 - CVSS 8.8 (high), 2026-09-16: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a…
CVE-2026-84656 - CVSS 4.3 (medium), 2026-09-02: A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build…
CVE-2026-84658 - CVSS 4.3 (medium), 2026-09-02: Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval…
CVE-2026-84655 - CVSS 4.3 (medium), 2026-09-02: Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing…
CVE-2026-84657 - CVSS 4.2 (medium), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a…
CVE-2026-84659 - CVSS 4.3 (medium), 2026-09-02: Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the…
CVE-2026-84646 - CVSS 4.3 (medium), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers…
CVE-2026-84651 - CVSS 6.3 (medium), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted…
CVE-2026-84645 - CVSS 8.8 (high), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in…
CVE-2026-84650 - CVSS 8.8 (high), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit…
CVE-2026-84653 - CVSS 3.5 (low), 2026-09-02: Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance…
CVE-2026-84648 - CVSS 8.8 (high), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a…
CVE-2026-84652 - CVSS 7.3 (high), 2026-09-02: In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing…
CVE-2026-70429 - CVSS 8.1 (high), 2026-08-05: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create…
CVE-2026-70430 - CVSS 2.7 (low), 2026-08-05: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy…
CVE-2026-70428 - CVSS 4.3 (medium), 2026-08-05: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with…
CVE-2026-70427 - CVSS 4.3 (medium), 2026-08-05: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and…
CVE-2026-57306 - CVSS 4.2 (medium), 2026-06-24: A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an…
CVE-2026-57307 - CVSS 4.2 (medium), 2026-06-24: A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an…
CVE-2026-57305 - CVSS 5.4 (medium), 2026-06-24: A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an…
CVE-2026-57304 - CVSS 5.4 (medium), 2026-06-24: A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL…
CVE-2026-57303 - CVSS 7.1 (high), 2026-06-24: Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the…
CVE-2026-57301 - CVSS 8.8 (high), 2026-06-24: Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with…