Jenkins vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
104 matching records
- Medium4.3A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.Check if you run itEPSS 0.29%Oct 29, 2025
- Medium4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server.Check if you run itEPSS 0.23%Oct 29, 2025
- Medium5.9Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property to an empty value, disabling a protection mechanism of the Java runtime.Check if you run itEPSS 0.32%Oct 29, 2025
- High7.1Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.Check if you run itEPSS 0.35%Oct 29, 2025
- Medium5.4A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code.Check if you run itEPSS 0.26%Oct 29, 2025
- Medium5.4Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information abouCheck if you run itEPSS 0.26%Oct 29, 2025
- High7.5Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a uCheck if you run itEPSS 0.47%Oct 29, 2025
- High8.7Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.843 and Application prior to version 20.0.1923 (VA/SaaS deployments) possess CI/CD weaknesses: theCheck if you run itEPSS 0.67%Sep 29, 2025
- Medium5.3Jenkins Jenkins Missing AuthorizationPatch nowKEVEPSS 5.00%Sep 17, 2025
- UnknownJenkins gitlab_hook Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 93.21%Jun 7, 2025
- High8.0Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641 and 1.625, resultingCheck if you run itEPSS 0.54%Jun 6, 2025
- Critical9.8In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log inCheck if you run itEPSS 0.65%May 14, 2025
- Medium5.9Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks.Check if you run itEPSS 0.23%May 14, 2025
- Medium4.3Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifieCheck if you run itEPSS 0.33%May 14, 2025
- Medium4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers to connect to an attacker-specified URLCheck if you run itEPSS 0.25%May 14, 2025
- High8.8Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scriptiCheck if you run itEPSS 0.56%May 14, 2025
- Critical9.1In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunctionCheck if you run itEPSS 0.64%May 14, 2025
- UnknownJenkins github Exposure of Sensitive Information to an Unauthorized ActorPatch nowKEVEPSS 90.89%Sep 19, 2024
- UnknownPipeline: Groovy Plugin 2.61 and earlier Sandbox BypassPatch nowKEVEPSS 86.05%Apr 15, 2024
- Critical9.8Jenkins Command Line Interface (CLI) Path Traversal VulnerabilityPatch nowKEVEPSS 100.00%Jan 24, 2024
- Medium4.3Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check f…Check if you run itEPSS 0.50%May 16, 2023
- UnknownScript Security Plugin Sandboxed Script Execution VulnerabilityPatch nowKEVEPSS 98.38%Jan 31, 2020
- Critical9.9Jenkins Matrix Project Plugin Remote Code Execution VulnerabilityPatch nowKEVEPSS 97.06%Mar 8, 2019
- Critical9.9Jenkins Script Security Plugin Sandbox Bypass VulnerabilityPatch nowKEVEPSS 74.44%Mar 8, 2019
- Critical9.8Jenkins Stapler Web Framework Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 98.33%Dec 10, 2018