Jenkins known exploited vulnerabilities
Every Jenkins CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 6 in all, 0 added in the last 12 months.
- CVE-2017-1000353Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution.org.jenkins-ci.main:jenkins-core
- CVE-2024-23897Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character folloJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2015-5317The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name inorg.jenkins-ci.main:jenkins-core
- CVE-2018-1000861A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/cororg.jenkins-ci.main:jenkins-core
- CVE-2019-1003029A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecuriJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2019-1003030A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/woJenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's next_cursor as cursor for the next page.
Frequently asked questions
How many Jenkins vulnerabilities are in CISA KEV?
6 Jenkins vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 0 of them added in the last 12 months. The newest is CVE-2017-1000353 (Jenkins Remote Code Execution Vulnerability), added 2025-10-02.
Which Jenkins products are in CISA KEV?
6 products, including Jenkins, Jenkins Command Line Interface (CLI), Jenkins User Interface (UI). Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Jenkins KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 1 of the 6 Jenkins entries.