Jenkins Project
Page 2 of 16 — Jenkins Project CVEs from a corpus of 1545, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64144 | Medium | 4.3 | 2025-10-29 | Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users wi… |
CVE-2025-64143 | Medium | 4.3 | 2025-10-29 | Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can b… |
CVE-2025-64142 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specif… |
CVE-2025-64141 | Medium | 4.3 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified UR… |
CVE-2025-64140 | High | 8.8 | 2025-10-29 | Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permiss… |
CVE-2025-64139 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-… |
CVE-2025-64138 | Medium | 4.3 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specif… |
CVE-2025-64137 | Medium | 4.3 | 2025-10-29 | A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP se… |
CVE-2025-64136 | Medium | 4.3 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server. |
CVE-2025-64135 | Medium | 5.9 | 2025-10-29 | Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value… |
CVE-2025-64134 | High | 7.1 | 2025-10-29 | Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external en… |
CVE-2025-64133 | Medium | 5.4 | 2025-10-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandb… |
CVE-2025-64132 | Medium | 5.4 | 2025-10-29 | Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and ob… |
CVE-2025-64131 | High | 7.5 | 2025-10-29 | Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentica… |
CVE-2025-59476 | Medium | 5.3 | 2025-09-17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messag… |
CVE-2025-59475 | Medium | 4.3 | 2025-09-17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers wit… |
CVE-2025-59474 | Medium | 5.3 | 2025-09-17 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Ove… |
CVE-2025-58460 | Medium | 4.2 | 2025-09-03 | A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an at… |
CVE-2025-58459 | Medium | 4.3 | 2025-09-03 | Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/… |
CVE-2025-58458 | Medium | 4.3 | 2025-09-03 | In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path… |
CVE-2025-53743 | Medium | 5.3 | 2025-07-09 | Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the potential for attac… |
CVE-2025-53742 | Medium | 6.5 | 2025-07-09 | Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be v… |
CVE-2025-53678 | Medium | 6.5 | 2025-07-09 | Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it ca… |
CVE-2025-53677 | Medium | 5.3 | 2025-07-09 | Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for attackers to obser… |
CVE-2025-53676 | Medium | 6.5 | 2025-07-09 | Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be… |
CVE-2025-53675 | Medium | 6.5 | 2025-07-09 | Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by us… |
CVE-2025-53674 | Medium | 5.3 | 2025-07-09 | Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, increasing the potent… |
CVE-2025-53673 | Medium | 6.5 | 2025-07-09 | Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins co… |
CVE-2025-53672 | Medium | 6.5 | 2025-07-09 | Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controller, where it can be… |
CVE-2025-53671 | Medium | 6.5 | 2025-07-09 | Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, inc… |
CVE-2025-53670 | Medium | 6.5 | 2025-07-09 | Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins… |
CVE-2025-53669 | Medium | 4.3 | 2025-07-09 | Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to obs… |
CVE-2025-53668 | Medium | 6.5 | 2025-07-09 | Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by us… |
CVE-2025-53667 | Medium | 5.3 | 2025-07-09 | Jenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, increasing the potential for attackers to… |
CVE-2025-53666 | Medium | 6.5 | 2025-07-09 | Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by… |
CVE-2025-53665 | Medium | 4.3 | 2025-07-09 | Jenkins Apica Loadtest Plugin 1.10 and earlier does not mask Apica Loadtest LTP authentication tokens displayed on the job configuration form, increasing the p… |
CVE-2025-53664 | Medium | 6.5 | 2025-07-09 | Jenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the Jenkins controller, w… |
CVE-2025-53663 | Medium | 6.5 | 2025-07-09 | Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job config.xml files on the Jenkins controller, where… |
CVE-2025-53662 | Medium | 6.5 | 2025-07-09 | Jenkins IFTTT Build Notifier Plugin 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job config.xml files on the Jenkins controller, where they c… |
CVE-2025-53661 | Medium | 4.3 | 2025-07-09 | Jenkins Testsigma Test Plan run Plugin 1.6 and earlier does not mask Testsigma API keys displayed on the job configuration form, increasing the potential for a… |
CVE-2025-53660 | Medium | 4.3 | 2025-07-09 | Jenkins QMetry Test Management Plugin 1.13 and earlier does not mask Qmetry Automation API Keys displayed on the job configuration form, increasing the potenti… |
CVE-2025-53659 | Medium | 6.5 | 2025-07-09 | Jenkins QMetry Test Management Plugin 1.13 and earlier stores Qmetry Automation API Keys unencrypted in job config.xml files on the Jenkins controller, where t… |
CVE-2025-53658 | Medium | 5.4 | 2025-07-09 | Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not escape the Applitools URL on the build page, resulting in a stored cross-site scripting (XSS) vulner… |
CVE-2025-53657 | Medium | 4.3 | 2025-07-09 | Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier does not mask SLM License Access Keys, client secrets, and passwords displayed on the job configura… |
CVE-2025-53656 | Medium | 6.5 | 2025-07-09 | Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier stores SLM License Access Keys, client secrets, and passwords unencrypted in job config.xml files o… |
CVE-2025-53655 | Medium | 5.3 | 2025-07-09 | Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers… |
CVE-2025-53654 | Medium | 6.5 | 2025-07-09 | Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it… |
CVE-2025-53653 | Medium | 4.3 | 2025-07-09 | Jenkins Aqua Security Scanner Plugin 3.2.8 and earlier stores Scanner Tokens for Aqua API unencrypted in job config.xml files on the Jenkins controller, where… |
CVE-2025-53652 | High | 8.2 | 2025-07-09 | Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered c… |
CVE-2025-53651 | Medium | 6.3 | 2025-07-09 | Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTML reports post-buil… |
CVE-2025-53650 | High | 7.3 | 2025-07-09 | Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present in exception error… |
CVE-2025-5806 | High | 8.0 | 2025-06-06 | Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641… |
CVE-2025-47889 | Critical | 9.8 | 2025-05-14 | In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticate… |
CVE-2025-47888 | Medium | 5.9 | 2025-05-14 | Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webho… |
CVE-2025-47887 | Medium | 4.3 | 2025-05-14 | Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permission to connect to… |
CVE-2025-47886 | Medium | 4.3 | 2025-05-14 | A cross-site request forgery (CSRF) vulnerability in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers to connect to an a… |
CVE-2025-47885 | High | 8.8 | 2025-05-14 | Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stor… |
CVE-2025-47884 | Critical | 9.1 | 2025-05-14 | In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment vari… |
CVE-2025-32755 | Critical | 9.1 | 2025-04-10 | In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on i… |
CVE-2025-32754 | Critical | 9.1 | 2025-04-10 | In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based o… |
CVE-2025-31728 | Medium | 5.5 | 2025-04-02 | Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasing the potential for… |
CVE-2025-31727 | Medium | 5.5 | 2025-04-02 | Jenkins AsakusaSatellite Plugin 0.1.1 and earlier stores AsakusaSatellite API keys unencrypted in job config.xml files on the Jenkins controller where they can… |
CVE-2025-31726 | Medium | 5.5 | 2025-04-02 | Jenkins Stack Hammer Plugin 1.0.6 and earlier stores Stack Hammer API keys unencrypted in job config.xml files on the Jenkins controller where they can be view… |
CVE-2025-31725 | Medium | 5.5 | 2025-04-02 | Jenkins monitor-remote-job Plugin 1.0 stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Ext… |
CVE-2025-31724 | Medium | 4.3 | 2025-04-02 | Jenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files on the Jenkins cont… |
CVE-2025-31723 | Medium | 4.3 | 2025-04-02 | A cross-site request forgery (CSRF) vulnerability in Jenkins Simple Queue Plugin 1.4.6 and earlier allows attackers to change and reset the build queue order. |
CVE-2025-31722 | High | 8.8 | 2025-04-02 | In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackers with Item/Configu… |
CVE-2025-31721 | Medium | 4.3 | 2025-04-02 | A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configur… |
CVE-2025-31720 | Medium | 4.3 | 2025-04-02 | A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended… |
CVE-2025-30197 | Low | 3.1 | 2025-03-19 | Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe a… |
CVE-2025-30196 | Medium | 6.5 | 2025-03-19 | Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the `javascript:` scheme, resulting in a st… |
CVE-2025-27625 | Medium | 4.3 | 2025-03-05 | In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attackers to perform ph… |
CVE-2025-27624 | Medium | 5.4 | 2025-03-05 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/e… |
CVE-2025-27623 | Medium | 4.3 | 2025-03-05 | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowi… |
CVE-2025-27622 | Medium | 4.3 | 2025-03-05 | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allow… |
CVE-2025-24403 | Medium | 4.3 | 2025-01-22 | A missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of… |
CVE-2025-24402 | Medium | 4.3 | 2025-01-22 | A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers to connect to a Service Fabric URL us… |
CVE-2025-24401 | Medium | 6.8 | 2025-01-22 | Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions configured to be granted are enabled, potent… |
CVE-2025-24400 | Medium | 4.3 | 2025-01-22 | Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, allowing attackers a… |
CVE-2025-24399 | High | 8.8 | 2025-01-22 | Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing… |
CVE-2025-24398 | High | 8.8 | 2025-01-22 | Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any ta… |
CVE-2025-24397 | Medium | 4.3 | 2025-01-22 | An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure p… |
CVE-2024-54004 | Medium | 4.3 | 2024-11-27 | Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, allowing attackers with… |
CVE-2024-54003 | High | 8.0 | 2024-11-27 | Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by atta… |
CVE-2024-52554 | High | 8.8 | 2024-11-13 | Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they're not executed i… |
CVE-2024-52553 | High | 8.8 | 2024-11-13 | Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login. |
CVE-2024-52552 | High | 8.0 | 2024-11-13 | Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored… |
CVE-2024-52551 | High | 8.0 | 2024-11-13 | Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a… |
CVE-2024-52550 | High | 8.0 | 2024-11-13 | Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebu… |
CVE-2024-52549 | Medium | 4.3 | 2024-11-13 | Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission c… |
CVE-2024-47807 | High | 8.1 | 2024-10-02 | Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to sub… |
CVE-2024-47806 | High | 8.1 | 2024-10-02 | Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to s… |
CVE-2024-47805 | High | 7.5 | 2024-10-02 | Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `Secr… |
CVE-2024-47804 | Medium | 4.3 | 2024-10-02 | If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Je… |
CVE-2024-47803 | Medium | 4.3 | 2024-10-02 | Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `sec… |
CVE-2024-43045 | Medium | 6.3 | 2024-08-07 | Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to… |
CVE-2024-43044 | High | 8.8 | 2024-08-07 | Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLo… |
CVE-2024-39460 | Medium | 4.3 | 2024-06-26 | Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in s… |
CVE-2024-39459 | Medium | 4.3 | 2024-06-26 | In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins… |
CVE-2024-39458 | Low | 3.1 | 2024-06-26 | When Jenkins Structs Plugin 337.v1b_04ea_4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that m… |