Jenkins security vulnerabilities
CI/CD. Public CVE monitoring for Jenkins. Vendor security advisories are linked on this page.
Built for CI administrators and platform teams.
104 public records · 0 security-fix timeline events. 18 published in the last 7 days. 73 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 1
- Medium 1
- Low 1
2026-08-053 issues2026-11-02
Known exploited
View all known exploited- High8.8Jenkins Jenkins Deserialization of Untrusted DataPatch nowKEVEPSS 53.13%Jun 10, 2026
- Medium5.3Jenkins Jenkins Missing AuthorizationPatch nowKEVEPSS 5.00%Sep 17, 2025
- Critical9.8Jenkins Command Line Interface (CLI) Path Traversal VulnerabilityPatch nowKEVEPSS 100.00%Jan 24, 2024
- High7.5Jenkins User Interface (UI) Information Disclosure VulnerabilityPatch nowKEVEPSS 23.00%Nov 25, 2015
- Critical9.9Jenkins Matrix Project Plugin Remote Code Execution VulnerabilityPatch nowKEVEPSS 97.06%Mar 8, 2019
- Critical9.9Jenkins Script Security Plugin Sandbox Bypass VulnerabilityPatch nowKEVEPSS 74.44%Mar 8, 2019
- Critical9.8Jenkins Stapler Web Framework Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 98.33%Dec 10, 2018
- Critical9.8Jenkins Remote Code Execution VulnerabilityPatch nowKEVEPSS 99.68%Jan 29, 2018
Recently published
Browse catalog- HighCVE-2026-99077: ipv4: udp: Create exceptions before socket matchingCheck if you run itEPSS 0.43%Oct 23, 2026
- High8.8Jenkins Jenkins Deserialization of Untrusted DataPatch nowKEVEPSS 53.13%Jun 10, 2026
- Medium4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failed Multijob builds.Check if you run itEPSS 0.15%May 27, 2026
- Medium4.3A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a pull request.Check if you run itEPSS 0.10%May 27, 2026
- Medium4.3Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.Check if you run itEPSS 0.21%May 27, 2026
- Medium6.6Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.Check if you run itEPSS 0.26%May 27, 2026
- Medium6.6Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.Check if you run itEPSS 0.22%May 27, 2026
- Medium6.9Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries.Check if you run itEPSS 0.15%Jan 13, 2026
- High8.2Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries.Check if you run itEPSS 0.27%Jan 13, 2026
- High8.7Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries.Check if you run itEPSS 0.13%Jan 13, 2026