Jenkins Project
Page 2 of 16 — Jenkins Project CVEs from a corpus of 1583, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48925 | Medium | 4.3 | 2026-05-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a… |
CVE-2026-48924 | Medium | 4.3 | 2026-05-27 | Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks. |
CVE-2026-48923 | Medium | 4.3 | 2026-05-27 | Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read… |
CVE-2026-48922 | High | 7.5 | 2026-05-27 | Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, allowing attackers a… |
CVE-2026-48921 | High | 7.5 | 2026-05-27 | Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to co… |
CVE-2026-48920 | High | 8.8 | 2026-05-27 | Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, witho… |
CVE-2026-48919 | Medium | 6.6 | 2026-05-27 | Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation. |
CVE-2026-48918 | Medium | 6.6 | 2026-05-27 | Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default. |
CVE-2026-48917 | Medium | 6.6 | 2026-05-27 | Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation. |
CVE-2026-48916 | Medium | 6.6 | 2026-05-27 | Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals. |
CVE-2026-42525 | Medium | 4.3 | 2026-04-29 | Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to per… |
CVE-2026-42524 | High | 8.0 | 2026-04-29 | Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vul… |
CVE-2026-42523 | Critical | 9.0 | 2026-04-29 | Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook tri… |
CVE-2026-42522 | Medium | 4.3 | 2026-04-29 | A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect t… |
CVE-2026-42521 | Medium | 6.5 | 2026-04-29 | Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration… |
CVE-2026-42520 | High | 7.5 | 2026-04-29 | Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to pr… |
CVE-2026-42519 | Medium | 4.3 | 2026-04-29 | A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending… |
CVE-2026-33004 | Medium | 4.3 | 2026-03-18 | Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential for attackers to ob… |
CVE-2026-33003 | Medium | 4.3 | 2026-03-18 | Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by us… |
CVE-2026-33002 | High | 7.5 | 2026-03-18 | Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebS… |
CVE-2026-33001 | High | 8.8 | 2026-03-18 | Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted a… |
CVE-2026-27100 | Medium | 4.3 | 2026-02-18 | Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, all… |
CVE-2026-27099 | High | 8.0 | 2026-02-18 | Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporari… |
CVE-2025-67643 | Medium | 4.3 | 2025-12-10 | Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory whi… |
CVE-2025-67642 | Medium | 4.3 | 2025-12-10 | Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/… |
CVE-2025-67641 | Medium | 5.4 | 2025-12-10 | Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when sub… |
CVE-2025-67640 | Medium | 5.0 | 2025-12-10 | Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell scrip… |
CVE-2025-67639 | Low | 3.5 | 2025-12-10 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the… |
CVE-2025-67638 | Medium | 4.3 | 2025-12-10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential f… |
CVE-2025-67637 | Medium | 4.3 | 2025-12-10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they c… |
CVE-2025-67636 | Medium | 4.3 | 2025-12-10 | A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values i… |
CVE-2025-67635 | High | 7.5 | 2025-12-10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing un… |
CVE-2025-64150 | Medium | 5.4 | 2025-10-29 | A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-speci… |
CVE-2025-64149 | Medium | 5.4 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an attacker-specified U… |
CVE-2025-64148 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of… |
CVE-2025-64147 | Medium | 4.3 | 2025-10-29 | Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and c… |
CVE-2025-64146 | Medium | 4.3 | 2025-10-29 | Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with It… |
CVE-2025-64145 | Medium | 4.3 | 2025-10-29 | Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe… |
CVE-2025-64144 | Medium | 4.3 | 2025-10-29 | Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users wi… |
CVE-2025-64143 | Medium | 4.3 | 2025-10-29 | Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can b… |
CVE-2025-64142 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specif… |
CVE-2025-64141 | Medium | 4.3 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified UR… |
CVE-2025-64140 | High | 8.8 | 2025-10-29 | Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permiss… |
CVE-2025-64139 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-… |
CVE-2025-64138 | Medium | 4.3 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specif… |
CVE-2025-64137 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP se… |
CVE-2025-64136 | Medium | 4.3 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server. |
CVE-2025-64135 | Medium | 5.9 | 2025-10-29 | Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value… |
CVE-2025-64134 | High | 7.1 | 2025-10-29 | Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external en… |
CVE-2025-64133 | Medium | 5.4 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandb… |
CVE-2025-64132 | Medium | 5.4 | 2025-10-29 | Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and ob… |
CVE-2025-64131 | High | 7.5 | 2025-10-29 | Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentica… |
CVE-2025-59476 | Medium | 5.3 | 2025-09-17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messag… |
CVE-2025-59475 | Medium | 4.3 | 2025-09-17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers wit… |
CVE-2025-59474 | Medium | 5.3 | 2025-09-17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Ove… |
CVE-2025-58460 | Medium | 4.2 | 2025-09-03 | A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an at… |
CVE-2025-58459 | Medium | 4.3 | 2025-09-03 | Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/… |
CVE-2025-58458 | Medium | 4.3 | 2025-09-03 | In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path… |
CVE-2025-53743 | Medium | 5.3 | 2025-07-09 | Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the potential for attac… |
CVE-2025-53742 | Medium | 6.5 | 2025-07-09 | Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be v… |
CVE-2025-53678 | Medium | 6.5 | 2025-07-09 | Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it ca… |
CVE-2025-53677 | Medium | 5.3 | 2025-07-09 | Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for attackers to obser… |
CVE-2025-53676 | Medium | 6.5 | 2025-07-09 | Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be… |
CVE-2025-53675 | Medium | 6.5 | 2025-07-09 | Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by us… |
CVE-2025-53674 | Medium | 5.3 | 2025-07-09 | Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, increasing the potent… |
CVE-2025-53673 | Medium | 6.5 | 2025-07-09 | Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins co… |
CVE-2025-53672 | Medium | 6.5 | 2025-07-09 | Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controller, where it can be… |
CVE-2025-53671 | Medium | 6.5 | 2025-07-09 | Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, inc… |
CVE-2025-53670 | Medium | 6.5 | 2025-07-09 | Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins… |
CVE-2025-53669 | Medium | 4.3 | 2025-07-09 | Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to obs… |
CVE-2025-53668 | Medium | 6.5 | 2025-07-09 | Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by us… |
CVE-2025-53667 | Medium | 5.3 | 2025-07-09 | Jenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, increasing the potential for attackers to… |
CVE-2025-53666 | Medium | 6.5 | 2025-07-09 | Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by… |
CVE-2025-53665 | Medium | 4.3 | 2025-07-09 | Jenkins Apica Loadtest Plugin 1.10 and earlier does not mask Apica Loadtest LTP authentication tokens displayed on the job configuration form, increasing the p… |
CVE-2025-53664 | Medium | 6.5 | 2025-07-09 | Jenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the Jenkins controller, w… |
CVE-2025-53663 | Medium | 6.5 | 2025-07-09 | Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job config.xml files on the Jenkins controller, where… |
CVE-2025-53662 | Medium | 6.5 | 2025-07-09 | Jenkins IFTTT Build Notifier Plugin 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job config.xml files on the Jenkins controller, where they c… |
CVE-2025-53661 | Medium | 4.3 | 2025-07-09 | Jenkins Testsigma Test Plan run Plugin 1.6 and earlier does not mask Testsigma API keys displayed on the job configuration form, increasing the potential for a… |
CVE-2025-53660 | Medium | 4.3 | 2025-07-09 | Jenkins QMetry Test Management Plugin 1.13 and earlier does not mask Qmetry Automation API Keys displayed on the job configuration form, increasing the potenti… |
CVE-2025-53659 | Medium | 6.5 | 2025-07-09 | Jenkins QMetry Test Management Plugin 1.13 and earlier stores Qmetry Automation API Keys unencrypted in job config.xml files on the Jenkins controller, where t… |
CVE-2025-53658 | Medium | 5.4 | 2025-07-09 | Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not escape the Applitools URL on the build page, resulting in a stored cross-site scripting (XSS) vulner… |
CVE-2025-53657 | Medium | 4.3 | 2025-07-09 | Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier does not mask SLM License Access Keys, client secrets, and passwords displayed on the job configura… |
CVE-2025-53656 | Medium | 6.5 | 2025-07-09 | Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier stores SLM License Access Keys, client secrets, and passwords unencrypted in job config.xml files o… |
CVE-2025-53655 | Medium | 5.3 | 2025-07-09 | Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers… |
CVE-2025-53654 | Medium | 6.5 | 2025-07-09 | Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it… |
CVE-2025-53653 | Medium | 4.3 | 2025-07-09 | Jenkins Aqua Security Scanner Plugin 3.2.8 and earlier stores Scanner Tokens for Aqua API unencrypted in job config.xml files on the Jenkins controller, where… |
CVE-2025-53652 | High | 8.2 | 2025-07-09 | Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered c… |
CVE-2025-53651 | Medium | 6.3 | 2025-07-09 | Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTML reports post-buil… |
CVE-2025-53650 | High | 7.3 | 2025-07-09 | Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present in exception error… |
CVE-2025-5806 | High | 8.0 | 2025-06-06 | Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641… |
CVE-2025-47889 | Critical | 9.8 | 2025-05-14 | In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticate… |
CVE-2025-47888 | Medium | 5.9 | 2025-05-14 | Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webho… |
CVE-2025-47887 | Medium | 4.3 | 2025-05-14 | Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permission to connect to… |
CVE-2025-47886 | Medium | 4.3 | 2025-05-14 | A cross-site request forgery (CSRF) vulnerability in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers to connect to an a… |
CVE-2025-47885 | High | 8.8 | 2025-05-14 | Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stor… |
CVE-2025-47884 | Critical | 9.1 | 2025-05-14 | In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment vari… |
CVE-2025-32755 | Critical | 9.1 | 2025-04-10 | In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on i… |
CVE-2025-32754 | Critical | 9.1 | 2025-04-10 | In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based o… |
CVE-2025-31728 | Medium | 5.5 | 2025-04-02 | Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasing the potential for… |
CVE-2025-31727 | Medium | 5.5 | 2025-04-02 | Jenkins AsakusaSatellite Plugin 0.1.1 and earlier stores AsakusaSatellite API keys unencrypted in job config.xml files on the Jenkins controller where they can… |