Jenkins project Jenkins
137 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-84657 | fixed in 2.580, 2.568.3 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s fla | MEDIUM 4.2 | 0.3 % | ||
| CVE-2026-84656 | fixed in 2.580, 2.568.3 | A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-84655 | fixed in 2.580, 2.568.3 | Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-84654 | fixed in 2.580, 2.568.3 | In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-84653 | fixed in 2.580, 2.568.3 | Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in t | LOW 3.5 | 0.3 % | ||
| CVE-2026-84652 | fixed in 2.580, 2.568.3 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me | HIGH 7.3 | 0.4 % | ||
| CVE-2026-84651 | fixed in 2.580, 2.568.3 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a subm | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-84650 | fixed in 2.580, 2.568.3 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to | HIGH 8.8 | 0.5 % | ||
| CVE-2026-84649 | fixed in 2.580, 2.568.3 | In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 th | HIGH 8.8 | 0.2 % | ||
| CVE-2026-84648 | fixed in 2.580, 2.568.3 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timesta | HIGH 8.8 | 0.6 % | ||
| CVE-2026-84647 | fixed in 2.580, 2.568.3 | In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, | HIGH 8.8 | 0.5 % | ||
| CVE-2026-84646 | fixed in 2.580, 2.568.3 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, all | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-84645 | fixed in 2.580, 2.568.3 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level confi | HIGH 8.8 | 0.8 % | ||
| CVE-2026-70430 | fixed in 2.576, 2.568.2 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project na | LOW 2.7 | 0.3 % | ||
| CVE-2026-70429 | fixed in 2.576, 2.568.2 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attacke | HIGH 8.1 | 0.4 % | ||
| CVE-2026-70428 | fixed in 2.576, 2.568.2 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allow | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-70427 | fixed in 2.576, 2.568.2 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-70426 | fixed in 2.576, 2.568.2 | In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, | CRITICAL 9.0 | 0.5 % | ||
| CVE-2026-53442 | fixed in 2.568, 2.555.3 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job conf | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-53441 | fixed in 2.568, 2.555.3 | Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-53440 | fixed in 2.568, 2.555.3 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-53439 | fixed in 2.568, 2.555.3 | Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine ot | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-53438 | fixed in 2.568, 2.555.3 | A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking I | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-53437 | fixed in 2.568, 2.555.3 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins | HIGH 7.4 | 0.5 % | ||
| CVE-2026-53436 | fixed in 2.568, 2.555.3 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-53435 | fixed in 2.568, 2.555.3 | In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in J | HIGH 8.8 | 53 % | ||
| CVE-2026-33002 | fixed in 2.555, 2.541.3 | Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made t | HIGH 7.5 | 0.3 % | ||
| CVE-2026-33001 | fixed in 2.555, 2.541.3 | Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, | HIGH 8.8 | 2.1 % | ||
| CVE-2026-27100 | fixed in 2.551, 2.541.2 | Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-27099 | fixed in 2.551, 2.541.2 | Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of | HIGH 8.0 | 0.5 % | ||
| CVE-2025-67639 | fixed in 2.541, 2.528.3 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into | LOW 3.5 | 0.2 % | ||
| CVE-2025-67638 | fixed in 2.541, 2.528.3 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increas | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-67637 | fixed in 2.541, 2.528.3 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins cont | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-67636 | fixed in 2.541, 2.528.3 | A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypte | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-67635 | fixed in 2.541, 2.528.3 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes cor | HIGH 7.5 | 0.6 % | ||
| CVE-2025-59476 | fixed in 2.516.3, 2.528 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified co | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-59475 | fixed in 2.516.3, 2.528 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, all | MEDIUM 4.3 | 0.5 % | ||
| CVE-2025-59474 | fixed in 2.516.3, 2.528 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible t | MEDIUM 5.3 | 5.0 % | ||
| CVE-2025-31721 | fixed in 2.492.3, 2.504 | A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but withou | MEDIUM 4.3 | 0.4 % | ||
| CVE-2025-31720 | fixed in 2.492.3, 2.504 | A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but withou | MEDIUM 4.3 | 0.4 % | ||
| CVE-2025-27625 | fixed in 2.492.2, 2.500 | In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing atta | MEDIUM 4.3 | 0.6 % | ||
| CVE-2025-27624 | fixed in 2.492.2, 2.500 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggl | MEDIUM 5.4 | 0.4 % | ||
| CVE-2025-27623 | fixed in 2.492.2, 2.500 | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-27622 | fixed in 2.492.2, 2.500 | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via RES | MEDIUM 4.3 | 0.8 % | ||
| CVE-2024-47804 | fixed in 2.462.3, 2.479 | If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGro | MEDIUM 4.3 | 0.7 % | ||
| CVE-2024-47803 | fixed in 2.462.3, 2.479 | Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions | MEDIUM 4.3 | 0.8 % | ||
| CVE-2024-43045 | fixed in 2.452.4, 2.462.1, 2.471 | Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/ | MEDIUM 6.3 | 2.9 % | ||
| CVE-2024-43044 | fixed in 2.452.4, 2.462.1, 2.471 | Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by | HIGH 8.8 | 29 % | ||
| CVE-2024-23898 | fixed in 2.442, 2.426.3, 2.440.1 | Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests ma | HIGH 8.8 | 67 % | ||
| CVE-2024-23897 | fixed in 2.442, 2.426.3, 2.440.1 | Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character follo | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2023-43498 | fixed in 2.424, 2.414.2 | In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the | HIGH 8.1 | 1.0 % | ||
| CVE-2023-43497 | fixed in 2.424, 2.414.2 | In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in th | HIGH 8.1 | 1.0 % | ||
| CVE-2023-43496 | fixed in 2.424, 2.414.2 | Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions f | HIGH 8.8 | 1.0 % | ||
| CVE-2023-43495 | fixed in 2.424, 2.414.2 | Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNot | MEDIUM 5.4 | 1.0 % | ||
| CVE-2023-43494 | fixed in 2.424, 2.414.2 | Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., p | MEDIUM 4.3 | 3.9 % | ||
| CVE-2023-39151 | fixed in 2.416, 2.401.3, 2.414.1 | Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyper | MEDIUM 5.4 | 1.0 % | ||
| CVE-2023-35141 | fixed in 2.400 | In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the U | HIGH 8.0 | 0.9 % | ||
| CVE-2023-27904 | fixed in 2.394, 2.375.4, 2.387.1 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, pot | MEDIUM 5.3 | 0.7 % | ||
| CVE-2023-27903 | fixed in 2.394, 2.375.4, 2.387.1 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions | MEDIUM 4.4 | 0.2 % | ||
| CVE-2023-27902 | fixed in 2.394, 2.375.4, 2.387.1 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/W | MEDIUM 4.3 | 0.7 % | ||
| CVE-2023-27901 | fixed in 2.394, 2.375.4, 2.387.1 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of re | HIGH 7.5 | 1.0 % | ||
| CVE-2023-27900 | fixed in 2.394, 2.375.4, 2.387.1 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of re | HIGH 7.5 | 1.0 % | ||
| CVE-2023-27899 | fixed in 2.394, 2.375.4, 2.387.1 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions | HIGH 7.0 | 0.2 % | ||
| CVE-2023-27898 | 2.270 – < 2.* | Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depe | CRITICAL 9.6 | 1.8 % | ||
| CVE-2022-41224 | 2.367 – < unspecified ; unspecified – 2.369 | Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins | MEDIUM 5.4 | 1.1 % | ||
| CVE-2022-34175 | 2.335 – < unspecified ; unspecified – 2.355 | Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing som | HIGH 7.5 | 1.4 % | ||
| CVE-2022-34174 | unspecified – 2.355 ; unspecified – LTS 2.332.3 | In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between logi | HIGH 7.5 | 1.6 % | ||
| CVE-2022-34173 | 2.340 – < unspecified ; unspecified – 2.355 | In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display | MEDIUM 5.4 | 1.5 % | ||
| CVE-2022-34172 | 2.340 – < unspecified ; unspecified – 2.355 | In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in | MEDIUM 5.4 | 1.5 % | ||
| CVE-2022-34171 | 2.321 – < unspecified ; unspecified – 2.355 ; LTS 2.332.1 – < unspecified ; … | In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbo | MEDIUM 5.4 | 1.6 % | ||
| CVE-2022-34170 | 2.320 – < unspecified ; unspecified – 2.355 ; LTS 2.332.1 – < unspecified ; … | In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the featu | MEDIUM 5.4 | 1.6 % | ||
| CVE-2022-0538 | unspecified – 2.333 ; unspecified – LTS 2.319.2 | Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for | HIGH 7.5 | 3.9 % | ||
| CVE-2022-20612 | unspecified – 2.329 ; unspecified – LTS 2.319.1 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of | MEDIUM 4.3 | 1.8 % | ||
| CVE-2021-21697 | unspecified – 2.318 ; unspecified – LTS 2.303.2 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins | CRITICAL 9.1 | 1.6 % | ||
| CVE-2021-21696 | unspecified – 2.318 ; unspecified – LTS 2.303.2 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories wh | CRITICAL 9.8 | 2.4 % | ||
| CVE-2021-21695 | unspecified – 2.318 ; unspecified – LTS 2.303.2 | FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earl | HIGH 8.8 | 2.1 % | ||
| CVE-2021-21694 | unspecified – 2.318 ; unspecified – LTS 2.303.2 | FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in | CRITICAL 9.8 | 1.6 % | ||
| CVE-2021-21692 | unspecified – 2.318 ; unspecified – LTS 2.303.2 | FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller | CRITICAL 9.8 | 2.1 % | ||
| CVE-2021-21691 | unspecified – 2.318 ; unspecified – LTS 2.303.2 | Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2. | CRITICAL 9.8 | 2.1 % | ||
| CVE-2021-21690 | unspecified – 2.318 ; unspecified – LTS 2.303.2 | Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and | CRITICAL 9.8 | 2.5 % | ||
| CVE-2021-21689 | unspecified – 2.318 ; unspecified – LTS 2.303.2 | FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and e | CRITICAL 9.1 | 1.5 % | ||
| CVE-2021-21688 | unspecified – 2.318 ; unspecified – LTS 2.303.2 | The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject a | HIGH 7.5 | 1.4 % | ||
| CVE-2021-21687 | unspecified – 2.318 ; unspecified – LTS 2.303.2 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a sym | CRITICAL 9.1 | 1.4 % | ||
| CVE-2021-21686 | unspecified – 2.318 ; unspecified – LTS 2.303.2 | File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize pa | HIGH 8.1 | 2.0 % | ||
| CVE-2021-21685 | unspecified – 2.318 ; unspecified – LTS 2.303.2 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs | CRITICAL 9.1 | 1.6 % | ||
| CVE-2021-21693 | unspecified – 2.318 ; unspecified – LTS 2.303.2 | When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 | CRITICAL 9.8 | 1.6 % | ||
| CVE-2021-21683 | unspecified – 2.314 ; unspecified – LTS 2.303.1 | The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting i | MEDIUM 6.5 | 2.2 % | ||
| CVE-2021-21682 | unspecified – 2.314 ; unspecified – LTS 2.303.1 | Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially repla | MEDIUM 4.3 | 1.0 % | ||
| CVE-2021-21671 | 2.266 – < unspecified ; LTS 2.277.1 – < unspecified ; unspecified – 2.299 ; … | Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login. | HIGH 7.5 | 1.8 % | ||
| CVE-2021-21670 | unspecified – 2.299 ; unspecified – LTS 2.289.1 | Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Canc | MEDIUM 4.3 | 2.0 % | ||
| CVE-2021-21640 | unspecified – 2.286 ; unspecified – LTS 2.277.1 | Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers | MEDIUM 4.3 | 1.9 % | ||
| CVE-2021-21639 | unspecified – 2.286 ; unspecified – LTS 2.277.1 | Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `con | MEDIUM 4.3 | 2.7 % | ||
| CVE-2021-21615 | 2.275 ; LTS 2.263.2 | Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-c | MEDIUM 5.3 | 0.9 % | ||
| CVE-2021-21611 | unspecified – 2.274 ; unspecified – LTS 2.263.1 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting | MEDIUM 5.4 | 1.0 % | ||
| CVE-2021-21610 | unspecified – 2.274 ; unspecified – LTS 2.263.1 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup p | MEDIUM 6.1 | 1.2 % | ||
| CVE-2021-21609 | unspecified – 2.274 ; unspecified – LTS 2.263.1 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing | MEDIUM 5.3 | 1.3 % | ||
| CVE-2021-21608 | unspecified – 2.274 ; unspecified – LTS 2.263.1 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS | MEDIUM 5.4 | 1.0 % | ||
| CVE-2021-21607 | unspecified – 2.274 ; unspecified – LTS 2.263.1 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attac | MEDIUM 6.5 | 1.5 % | ||
| CVE-2021-21606 | 2.242 – < unspecified ; unspecified – 2.274 ; unspecified – LTS 2.263.1 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existe | MEDIUM 4.3 | 1.2 % | ||
| CVE-2021-21605 | unspecified – 2.274 ; unspecified – LTS 2.263.1 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to | HIGH 8.0 | 2.2 % | ||
| CVE-2021-21604 | unspecified – 2.274 ; unspecified – LTS 2.263.1 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted | HIGH 8.0 | 1.7 % | ||
| CVE-2021-21603 | unspecified – 2.274 ; unspecified – LTS 2.263.1 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting ( | MEDIUM 5.4 | 1.0 % | ||
| CVE-2021-21602 | unspecified – 2.274 ; unspecified – LTS 2.263.1 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifac | MEDIUM 6.5 | 2.3 % | ||
| CVE-2020-2231 | unspecified – 2.251 ; unspecified – LTS 2.235.3 | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remot | MEDIUM 5.4 | 5.3 % | ||
| CVE-2020-2230 | unspecified – 2.251 ; unspecified – LTS 2.235.3 | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site | MEDIUM 5.4 | 83 % | ||
| CVE-2020-2229 | unspecified – 2.251 ; unspecified – LTS 2.235.3 | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scrip | MEDIUM 5.4 | 6.8 % | ||
| CVE-2020-2223 | unspecified – 2.244 ; unspecified – LTS 2.235.1 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in t | MEDIUM 5.4 | 1.0 % | ||
| CVE-2020-2222 | unspecified – 2.244 ; unspecified – LTS 2.235.1 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in | MEDIUM 5.4 | 1.1 % | ||
| CVE-2020-2221 | unspecified – 2.244 ; unspecified – LTS 2.235.1 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting | MEDIUM 5.4 | 1.1 % | ||
| CVE-2020-2220 | unspecified – 2.244 ; unspecified – LTS 2.235.1 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross- | MEDIUM 5.4 | 1.0 % | ||
| CVE-2020-2163 | unspecified – 2.227 ; unspecified – LTS 2.204.5 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS | MEDIUM 5.4 | 1.2 % | ||
| CVE-2020-2162 | unspecified – 2.227 ; unspecified – LTS 2.204.5 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a b | MEDIUM 5.4 | 1.2 % | ||
| CVE-2020-2161 | unspecified – 2.227 ; unspecified – LTS 2.204.5 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expr | MEDIUM 5.4 | 1.2 % | ||
| CVE-2020-2160 | unspecified – 2.227 ; unspecified – LTS 2.204.5 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs | HIGH 8.8 | 2.0 % | ||
| CVE-2012-0785 | before 1.447 | Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before | HIGH 7.5 | 3.4 % | ||
| CVE-2020-2105 | unspecified – 2.218 ; unspecified – LTS 2.204.1 | REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks. | MEDIUM 5.4 | 1.8 % | ||
| CVE-2020-2104 | unspecified – 2.218 ; unspecified – LTS 2.204.1 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart. | MEDIUM 4.3 | 1.1 % | ||
| CVE-2020-2103 | unspecified – 2.218 ; unspecified – LTS 2.204.1 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page. | MEDIUM 5.4 | 7.0 % | ||
| CVE-2020-2102 | unspecified – 2.218 ; unspecified – LTS 2.204.1 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC. | MEDIUM 5.3 | 1.4 % | ||
| CVE-2020-2101 | unspecified – 2.218 ; unspecified – LTS 2.204.1 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which | MEDIUM 5.3 | 1.4 % | ||
| CVE-2020-2100 | unspecified – 2.218 ; unspecified – LTS 2.204.1 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848. | MEDIUM 5.8 | 3.4 % | ||
| CVE-2020-2099 | unspecified – 2.213 ; unspecified – LTS 2.204.1 | Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing | HIGH 8.6 | 1.0 % | ||
| CVE-2019-10406 | 2.196 and earlier, LTS 2.176.3 and earlier | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulti | MEDIUM 4.8 | 1.0 % | ||
| CVE-2019-10405 | 2.196 and earlier, LTS 2.176.3 and earlier | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attac | MEDIUM 5.4 | 65 % | ||
| CVE-2019-10404 | 2.196 and earlier, LTS 2.176.3 and earlier | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored | MEDIUM 5.4 | 1.0 % | ||
| CVE-2019-10403 | 2.196 and earlier, LTS 2.176.3 and earlier | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored | MEDIUM 5.4 | 1.0 % | ||
| CVE-2019-10402 | 2.196 and earlier, LTS 2.176.3 and earlier | In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a store | MEDIUM 5.4 | 1.0 % | ||
| CVE-2019-10401 | 2.196 and earlier, LTS 2.176.3 and earlier | In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, r | MEDIUM 5.4 | 1.0 % | ||
| CVE-2019-10384 | 2.191 and earlier, LTS 2.176.2 and earlier | Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CS | HIGH 8.8 | 1.6 % | ||
| CVE-2019-10383 | 2.191 and earlier, LTS 2.176.2 and earlier | A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer | MEDIUM 4.8 | 1.4 % | ||
| CVE-2019-10354 | 2.185 and earlier, LTS 2.176.1 and earlier | A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fra | MEDIUM 4.3 | 1.6 % | ||
| CVE-2019-10353 | 2.185 and earlier, LTS 2.176.1 and earlier | CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass C | HIGH 7.5 | 1.5 % | ||
| CVE-2019-10352 | 2.185 and earlier, LTS 2.176.1 and earlier | A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.j | MEDIUM 6.5 | 10 % | ||
| CVE-2019-1003050 | 2.171 and earlier, LTS 2.164.1 and earlier | The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 a | MEDIUM 5.4 | 1.3 % | ||
| CVE-2019-1003049 | 2.171 and earlier, LTS 2.164.1 and earlier | Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in | HIGH 8.1 | 2.1 % | ||
| CVE-2019-1003004 | 2.158 and earlier, LTS 2.150.1 and earlier | An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/A | HIGH 7.2 | 1.6 % | ||
| CVE-2019-1003003 | 2.158 and earlier, LTS 2.150.1 and earlier | An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/T | HIGH 7.2 | 1.5 % |