# cve.now: Jenkins

The newest entries affecting Jenkins (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-117626](https://cve.now/CVE-2026-117626.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for worksp (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117625](https://cve.now/CVE-2026-117625.md): A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117624](https://cve.now/CVE-2026-117624.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117623](https://cve.now/CVE-2026-117623.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, r (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117622](https://cve.now/CVE-2026-117622.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the c (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117621](https://cve.now/CVE-2026-117621.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file an (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117620](https://cve.now/CVE-2026-117620.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117619](https://cve.now/CVE-2026-117619.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API toke (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117618](https://cve.now/CVE-2026-117618.md): In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setu (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117617](https://cve.now/CVE-2026-117617.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its paren (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117616](https://cve.now/CVE-2026-117616.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117615](https://cve.now/CVE-2026-117615.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing atta (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117614](https://cve.now/CVE-2026-117614.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117613](https://cve.now/CVE-2026-117613.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers wit (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117612](https://cve.now/CVE-2026-117612.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the \`resolves-to\` attr (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-92141](https://cve.now/CVE-2026-92141.md): Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phish (CVSS 4.3, Jenkins Project Jenkins Keycloak Authentication Plugin)
- [CVE-2026-92140](https://cve.now/CVE-2026-92140.md): Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, result (CVSS 6.8, Jenkins Project Jenkins Gitee Plugin)
- [CVE-2026-92139](https://cve.now/CVE-2026-92139.md): Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and (CVSS 6.5, Jenkins Project Jenkins Bitbucket Push and Pull Request Plu…)
- [CVE-2026-92138](https://cve.now/CVE-2026-92138.md): The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the \`oauth\_callback\` URL from the su (CVSS 4.2, Jenkins Project Jenkins Bitbucket Server Integration Plugin)
- [CVE-2026-92137](https://cve.now/CVE-2026-92137.md): Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is co (CVSS 8.8, Jenkins Project Jenkins Robot Framework Plugin)
- [CVE-2026-92136](https://cve.now/CVE-2026-92136.md): Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resultin (CVSS 8.0, Jenkins Project Jenkins OWASP Dependency-Check Plugin)
- [CVE-2026-92135](https://cve.now/CVE-2026-92135.md): Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted thr (CVSS 8.0, Jenkins Project Jenkins Coverage Plugin)
- [CVE-2026-92134](https://cve.now/CVE-2026-92134.md): Jenkins Warnings Plugin 13.10258.va\_17d49a\_78c3b\_ and earlier does not validate the analysis results ID when a job configuration is submitte (CVSS 8.0, Jenkins Project Jenkins Warnings Plugin)
- [CVE-2026-92133](https://cve.now/CVE-2026-92133.md): Jenkins GitLab Plugin 1.2149.vcfc32c82b\_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials unde (CVSS 5.4, Jenkins Project Jenkins GitLab Plugin)
- [CVE-2026-92132](https://cve.now/CVE-2026-92132.md): Jenkins Gradle Plugin 2.19.1252.v15196b\_5a\_6e10 and earlier requests build scan data from the build scan link detected in the build log, eve (CVSS 5.4, Jenkins Project Jenkins Gradle Plugin)
- [CVE-2026-92131](https://cve.now/CVE-2026-92131.md): Jenkins Pipeline: Groovy Libraries Plugin 805.va\_fc79344957d and earlier does not restrict the library path provided to the library Pipeline (CVSS 4.2, Jenkins Project Jenkins Pipeline: Groovy Libraries Plugin)
- [CVE-2026-92130](https://cve.now/CVE-2026-92130.md): Jenkins Pipeline: Multibranch Plugin 841.vec5b\_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resol (CVSS 3.1, Jenkins Project Jenkins Pipeline: Multibranch Plugin)
- [CVE-2026-92129](https://cve.now/CVE-2026-92129.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to (CVSS 7.5, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-92128](https://cve.now/CVE-2026-92128.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the (CVSS 7.5, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-92127](https://cve.now/CVE-2026-92127.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier automatically approves the classpath entries in an item configuration when (CVSS 8.0, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-92126](https://cve.now/CVE-2026-92126.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an (CVSS 7.2, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-92125](https://cve.now/CVE-2026-92125.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing atta (CVSS 8.8, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-92124](https://cve.now/CVE-2026-92124.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier checks the operations Groovy will perform with the elements it reads from a (CVSS 8.8, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-92123](https://cve.now/CVE-2026-92123.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier does not intercept operations performed on a null receiver (method calls, p (CVSS 8.8, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-92122](https://cve.now/CVE-2026-92122.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier does not check the method called through the proxy created when a sandboxed (CVSS 8.8, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-84677](https://cve.now/CVE-2026-84677.md): Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugi (CVSS 5.4, Jenkins Project Jenkins update-center2)
- [CVE-2026-84676](https://cve.now/CVE-2026-84676.md): Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller wh (CVSS 4.3, Jenkins Project Jenkins Parameterized Remote Trigger Plugin)
- [CVE-2026-84675](https://cve.now/CVE-2026-84675.md): OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable v (CVSS 7.4, Jenkins Project Jenkins TICS Plugin)
- [CVE-2026-84674](https://cve.now/CVE-2026-84674.md): Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate (CVSS 5.4, Jenkins Project Jenkins XebiaLabs XL Deploy Plugin)
- [CVE-2026-84673](https://cve.now/CVE-2026-84673.md): Jenkins Customizable Header Plugin 295.v2544b\_ca\_19b\_97 and earlier allows overwriting the plugin's appearance configuration through Stapler (CVSS 8.8, Jenkins Project Jenkins Customizable Header Plugin)
- [CVE-2026-84672](https://cve.now/CVE-2026-84672.md): Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b\_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's (CVSS 8.8, Jenkins Project Jenkins Microsoft Entra ID (previously Azur…)
- [CVE-2026-84671](https://cve.now/CVE-2026-84671.md): Jenkins File Parameter Plugin 425.v3fa\_801681b\_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file sys (CVSS 8.8, Jenkins Project Jenkins File Parameter Plugin)
- [CVE-2026-84670](https://cve.now/CVE-2026-84670.md): Jenkins Performance Plugin 1015.v09ca\_52b\_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached (CVSS 8.8, Jenkins Project Jenkins Performance Plugin)
- [CVE-2026-84669](https://cve.now/CVE-2026-84669.md): A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish A (CVSS 8.8, Jenkins Project Jenkins Allure Plugin)
- [CVE-2026-84668](https://cve.now/CVE-2026-84668.md): Jenkins SAML Plugin 4.618.v441a\_27fa\_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data bindi (CVSS 8.8, Jenkins Project Jenkins SAML Plugin)
- [CVE-2026-84667](https://cve.now/CVE-2026-84667.md): Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing atta (CVSS 7.1, Jenkins Project Jenkins ThinBackup Plugin)
- [CVE-2026-84666](https://cve.now/CVE-2026-84666.md): Jenkins Job Configuration History Plugin 1367.vc8fa\_b\_15101dc and earlier allows overwriting the plugin's history recording configuration th (CVSS 5.4, Jenkins Project Jenkins Job Configuration History Plugin)
- [CVE-2026-84665](https://cve.now/CVE-2026-84665.md): Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner (CVSS 8.0, Jenkins Project Jenkins SonarQube Scanner Plugin)
- [CVE-2026-84664](https://cve.now/CVE-2026-84664.md): Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowin (CVSS 5.4, Jenkins Project Jenkins GitLab Plugin)
- [CVE-2026-84663](https://cve.now/CVE-2026-84663.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attacker (CVSS 5.4, Jenkins Project Jenkins Pipeline: Groovy Libraries Plugin)
- [CVE-2026-84662](https://cve.now/CVE-2026-84662.md): Jenkins LDAP Plugin 807.809.vd3a\_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers (CVSS 4.3, Jenkins Project Jenkins LDAP Plugin)
- [CVE-2026-84661](https://cve.now/CVE-2026-84661.md): A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b\_67ea\_11b\_152 and earlier causes downstream builds awaited by the \` (CVSS 5.4, Jenkins Project Jenkins Pipeline: Build Step Plugin)
- [CVE-2026-84660](https://cve.now/CVE-2026-84660.md): A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b\_67ea\_11b\_152 and earlier causes downstream builds triggered by the (CVSS 5.4, Jenkins Project Jenkins Pipeline: Build Step Plugin)
- [CVE-2026-84659](https://cve.now/CVE-2026-84659.md): Jenkins Script Security Plugin 1412.v7737b\_3405f86 and earlier does not enforce a permission check in the method that controls the "Force th (CVSS 4.3, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-84658](https://cve.now/CVE-2026-84658.md): Jenkins Script Security Plugin 1412.v7737b\_3405f86 and earlier uses the \`@DataBoundConstructor\` annotation on a constructor that loads scrip (CVSS 4.3, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-84657](https://cve.now/CVE-2026-84657.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s fla (CVSS 4.2, Jenkins Project Jenkins)
- [CVE-2026-84656](https://cve.now/CVE-2026-84656.md): A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one (CVSS 4.3, Jenkins Project Jenkins)
- [CVE-2026-84655](https://cve.now/CVE-2026-84655.md): Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API (CVSS 4.3, Jenkins Project Jenkins)
- [CVE-2026-84654](https://cve.now/CVE-2026-84654.md): In Stapler 2107.v8dfcb\_e8ed317 and earlier, except 2088.2093.vd7c3e58008a\_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, (CVSS 5.4, Jenkins Project Jenkins)
- [CVE-2026-84653](https://cve.now/CVE-2026-84653.md): Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in t (CVSS 3.5, Jenkins Project Jenkins)
- [CVE-2026-84652](https://cve.now/CVE-2026-84652.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me (CVSS 7.3, Jenkins Project Jenkins)
- [CVE-2026-84651](https://cve.now/CVE-2026-84651.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a subm (CVSS 6.3, Jenkins Project Jenkins)
- [CVE-2026-84650](https://cve.now/CVE-2026-84650.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to (CVSS 8.8, Jenkins Project Jenkins)
- [CVE-2026-84649](https://cve.now/CVE-2026-84649.md): In Stapler 1839.ved17667b\_a\_eb\_5 through 2107.v8dfcb\_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a\_6, included in Jenkins 2.447 th (CVSS 8.8, Jenkins Project Jenkins)
- [CVE-2026-84648](https://cve.now/CVE-2026-84648.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timesta (CVSS 8.8, Jenkins Project Jenkins)
- [CVE-2026-84647](https://cve.now/CVE-2026-84647.md): In Stapler 2107.v8dfcb\_e8ed317 and earlier, except 2088.2093.vd7c3e58008a\_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, (CVSS 8.8, Jenkins Project Jenkins)
- [CVE-2026-84646](https://cve.now/CVE-2026-84646.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, all (CVSS 4.3, Jenkins Project Jenkins)
- [CVE-2026-84645](https://cve.now/CVE-2026-84645.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level confi (CVSS 8.8, Jenkins Project Jenkins)
- [CVE-2026-70448](https://cve.now/CVE-2026-70448.md): Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing Ivy (CVSS 7.1, Jenkins Project Jenkins Ivy Report Plugin)
- [CVE-2026-70447](https://cve.now/CVE-2026-70447.md): Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credent (CVSS 4.3, Jenkins Project Jenkins AWS CodeBuild Plugin)
- [CVE-2026-70446](https://cve.now/CVE-2026-70446.md): Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credential (CVSS 4.3, Jenkins Project Jenkins CodeSonar Plugin)
- [CVE-2026-70445](https://cve.now/CVE-2026-70445.md): Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate crede (CVSS 4.3, Jenkins Project Jenkins Sauce OnDemand Plugin)
- [CVE-2026-70444](https://cve.now/CVE-2026-70444.md): A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission t (CVSS 4.3, Jenkins Project Jenkins Violation Comments to GitLab Plugin)
- [CVE-2026-70443](https://cve.now/CVE-2026-70443.md): Jenkins Horreum Plugin 0.16.162.v33b\_4a\_a\_b\_5f828 and earlier does not set the appropriate context for credentials lookup, allowing attacker (CVSS 4.3, Jenkins Project Jenkins Horreum Plugin)
- [CVE-2026-70442](https://cve.now/CVE-2026-70442.md): Jenkins Google Chat Notification Plugin 166.ve6b\_de280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing (CVSS 4.3, Jenkins Project Jenkins Google Chat Notification Plugin)
- [CVE-2026-70441](https://cve.now/CVE-2026-70441.md): Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a s (CVSS 5.4, Jenkins Project Jenkins Summary Display Plugin)
- [CVE-2026-70440](https://cve.now/CVE-2026-70440.md): Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, (CVSS 5.4, Jenkins Project Jenkins Qualys Container Scanning Connector…)
- [CVE-2026-70439](https://cve.now/CVE-2026-70439.md): Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions (CVSS 6.5, Jenkins Project Jenkins XML Job to Job DSL Plugin)
- [CVE-2026-70438](https://cve.now/CVE-2026-70438.md): A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to (CVSS 4.3, Jenkins Project Jenkins Parameterized Remote Trigger Plugin)
- [CVE-2026-70437](https://cve.now/CVE-2026-70437.md): Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa\_f0215cf5 and earlier does not use a constant-time comparison function when check (CVSS 3.7, Jenkins Project Jenkins Webhook Secret Credentials Provider…)
- [CVE-2026-70436](https://cve.now/CVE-2026-70436.md): Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper (CVSS 4.3, Jenkins Project Jenkins External Workspace Manager Plugin)
- [CVE-2026-70435](https://cve.now/CVE-2026-70435.md): A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an a (CVSS 4.2, Jenkins Project Jenkins SCM-Manager Plugin)
- [CVE-2026-70434](https://cve.now/CVE-2026-70434.md): A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacke (CVSS 4.2, Jenkins Project Jenkins SCM-Manager Plugin)
- [CVE-2026-70433](https://cve.now/CVE-2026-70433.md): Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credenti (CVSS 4.3, Jenkins Project Jenkins HCL AppScan Plugin)
- [CVE-2026-70432](https://cve.now/CVE-2026-70432.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a\_d9c71b\_0 and earlier allows attackers to execute arb (CVSS 8.8, Jenkins Project Jenkins Multijob Plugin)
- [CVE-2026-70431](https://cve.now/CVE-2026-70431.md): Jenkins Multijob Plugin 669.v9d96a\_d9c71b\_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin (CVSS 8.8, Jenkins Project Jenkins Multijob Plugin)
- [CVE-2026-70430](https://cve.now/CVE-2026-70430.md): Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project na (CVSS 2.7, Jenkins Project Jenkins)
- [CVE-2026-70429](https://cve.now/CVE-2026-70429.md): Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attacke (CVSS 8.1, Jenkins Project Jenkins)
- [CVE-2026-70428](https://cve.now/CVE-2026-70428.md): Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allow (CVSS 4.3, Jenkins Project Jenkins)
- [CVE-2026-70427](https://cve.now/CVE-2026-70427.md): Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction (CVSS 4.3, Jenkins Project Jenkins)
- [CVE-2026-70426](https://cve.now/CVE-2026-70426.md): In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, (CVSS 9.0, Jenkins Project Jenkins · Jenkins Project Remoting)
- [CVE-2026-57307](https://cve.now/CVE-2026-57307.md): A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b\_450b\_1 and earlier allows attackers with Overall/Read permission (CVSS 4.2, Jenkins Project Jenkins Zowe zDevOps Plugin · io.jenkins.pl…)
- [CVE-2026-57306](https://cve.now/CVE-2026-57306.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b\_450b\_1 and earlier allows attackers to co (CVSS 4.2, Jenkins Project Jenkins Zowe zDevOps Plugin · io.jenkins.pl…)
- [CVE-2026-57305](https://cve.now/CVE-2026-57305.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-spec (CVSS 5.4, Jenkins Project Jenkins Assembla Plugin · org.jenkins-ci.pl…)
- [CVE-2026-57304](https://cve.now/CVE-2026-57304.md): A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacke (CVSS 5.4, Jenkins Project Jenkins Assembla Plugin · org.jenkins-ci.pl…)
- [CVE-2026-57303](https://cve.now/CVE-2026-57303.md): Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers a (CVSS 7.1, Jenkins Project Jenkins Assembla Plugin · org.jenkins-ci.pl…)
- [CVE-2026-57302](https://cve.now/CVE-2026-57302.md): Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be v (CVSS 4.3, Jenkins Project Jenkins FitNesse Plugin · org.jenkins-ci.pl…)
- [CVE-2026-57301](https://cve.now/CVE-2026-57301.md): Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing atta (CVSS 8.8, Jenkins Project Jenkins OWASP ZAP Plugin · org.jenkins-ci.p…)
- [CVE-2026-57300](https://cve.now/CVE-2026-57300.md): A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb\_2557fe and earlier allows attackers with Item/Read permission to read (CVSS 4.3, Jenkins Project Jenkins MCP Server Plugin · io.jenkins.plug…)
- [CVE-2026-57299](https://cve.now/CVE-2026-57299.md): Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read perm (CVSS 4.3, Jenkins Project Jenkins Contrast Continuous Application Sec…)
- [CVE-2026-57298](https://cve.now/CVE-2026-57298.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attacke (CVSS 5.4, Jenkins Project Jenkins Contrast Continuous Application Sec…)
- [CVE-2026-57297](https://cve.now/CVE-2026-57297.md): A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read pe (CVSS 5.4, Jenkins Project Jenkins Contrast Continuous Application Sec…)
- [CVE-2026-57296](https://cve.now/CVE-2026-57296.md): Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided t (CVSS 8.8, Jenkins Project Jenkins External Workspace Manager Plugin ·…)
- [CVE-2026-57295](https://cve.now/CVE-2026-57295.md): A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a\_81c3 and earlier allows attackers to conne (CVSS 5.4, Jenkins Project Jenkins EC2 Fleet Plugin · com.amazon.jenki…)
- [CVE-2026-57294](https://cve.now/CVE-2026-57294.md): A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a\_81c3 and earlier allows attackers with Overall/Read permission to (CVSS 5.4, Jenkins Project Jenkins EC2 Fleet Plugin · com.amazon.jenki…)
- [CVE-2026-57293](https://cve.now/CVE-2026-57293.md): An incorrect permission check in Jenkins Gitee Plugin 1288.v18b\_deb\_c9069b\_ and earlier allows attackers with global Item/Configure permissi (CVSS 4.3, Jenkins Project Jenkins Gitee Plugin · org.jenkins-ci.plugi…)
- [CVE-2026-57292](https://cve.now/CVE-2026-57292.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b\_deb\_c9069b\_ and earlier allows attackers to connect to a (CVSS 5.4, Jenkins Project Jenkins Gitee Plugin · org.jenkins-ci.plugi…)
- [CVE-2026-57291](https://cve.now/CVE-2026-57291.md): Missing permission checks in Jenkins Gitee Plugin 1288.v18b\_deb\_c9069b\_ and earlier allow attackers with Overall/Read permission to connect (CVSS 5.4, Jenkins Project Jenkins Gitee Plugin · org.jenkins-ci.plugi…)
- [CVE-2026-57290](https://cve.now/CVE-2026-57290.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b\_84449 and earlier allows attackers to overw (CVSS 4.3, Jenkins Project Jenkins Priority Sorter Plugin · org.jenkin…)
- [CVE-2026-57289](https://cve.now/CVE-2026-57289.md): Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for co (CVSS 4.8, Jenkins Project Jenkins Bitbucket Push and Pull Request Plu…)
- [CVE-2026-57288](https://cve.now/CVE-2026-57288.md): Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows nativ (CVSS 3.7, Jenkins Project Jenkins Active Directory Plugin · org.jenki…)
- [CVE-2026-57287](https://cve.now/CVE-2026-57287.md): Jenkins Job Configuration History Plugin 1356.ve360da\_6c523a\_ and earlier does not redact the encrypted values of secrets when displaying hi (CVSS 4.3, Jenkins Project Jenkins Job Configuration History Plugin ·…)
- [CVE-2026-57286](https://cve.now/CVE-2026-57286.md): A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca\_ and earlier allows attackers with Item/Read permission to obta (CVSS 4.3, Jenkins Project Jenkins Git Parameter Plugin · org.jenkins-…)
- [CVE-2026-57285](https://cve.now/CVE-2026-57285.md): A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read per (CVSS 4.3, Jenkins Project Jenkins GitHub Branch Source Plugin · org.j…)
- [CVE-2026-57284](https://cve.now/CVE-2026-57284.md): Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Sni (CVSS 4.3, Jenkins Project Jenkins Pipeline: Groovy Plugin · io.jenkin…)
- [CVE-2026-57283](https://cve.now/CVE-2026-57283.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to inst (CVSS 4.3, Jenkins Project Jenkins Pipeline: Groovy Plugin · io.jenkin…)
- [CVE-2026-57282](https://cve.now/CVE-2026-57282.md): Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH (CVSS 5.0, Jenkins Project Jenkins Git client Plugin · org.jenkins-ci.…)
- [CVE-2026-57281](https://cve.now/CVE-2026-57281.md): Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions m (CVSS 7.5, Jenkins Project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2026-57280](https://cve.now/CVE-2026-57280.md): Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed fo (CVSS 8.8, Jenkins Project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2026-53442](https://cve.now/CVE-2026-53442.md): Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job conf (CVSS 5.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-53441](https://cve.now/CVE-2026-53441.md): Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of (CVSS 5.4, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-53440](https://cve.now/CVE-2026-53440.md): Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-53439](https://cve.now/CVE-2026-53439.md): Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine ot (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-53438](https://cve.now/CVE-2026-53438.md): A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking I (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-53437](https://cve.now/CVE-2026-53437.md): Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-53436](https://cve.now/CVE-2026-53436.md): Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-53435](https://cve.now/CVE-2026-53435.md): In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in J (CVSS 8.8, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-10276](https://cve.now/CVE-2026-10276.md): hekmon8 Jenkins-server-mcp get\_build\_status/get\_build\_log/trigger\_build index.ts jobPath server-side request forgery (CVSS 5.3, hekmon8 Jenkins-server-mcp)
- [CVE-2026-9674](https://cve.now/CVE-2026-9674.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b\_b\_d and earlier allows attackers to resume fail (CVSS 4.3, Jenkins Project Jenkins Multijob Plugin · org.jenkins-ci.pl…)
- [CVE-2026-48927](https://cve.now/CVE-2026-48927.md): Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerability (CVSS 5.5, Jenkins Project Jenkins buildgraph-view Plugin · org.jenkin…)
- [CVE-2026-48926](https://cve.now/CVE-2026-48926.md): Jenkins Job Import Plugin 143.v044a\_2e819b\_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with O (CVSS 4.3, Jenkins Project Jenkins Job Import Plugin · org.jenkins-ci.…)
- [CVE-2026-48925](https://cve.now/CVE-2026-48925.md): A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to tr (CVSS 4.3, Jenkins Project Jenkins GitHub Integration Plugin · org.jen…)
- [CVE-2026-48924](https://cve.now/CVE-2026-48924.md): Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attac (CVSS 4.3, Jenkins Project Jenkins Bitbucket OAuth Plugin · org.jenkin…)
- [CVE-2026-48923](https://cve.now/CVE-2026-48923.md): Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers (CVSS 4.3, Jenkins Project Jenkins AppSpider Plugin · com.rapid7:jenki…)
- [CVE-2026-48922](https://cve.now/CVE-2026-48922.md): Jenkins Credentials Binding Plugin 720.v3f6decef43ea\_ and earlier does not properly sanitize file names for file and zip file credentials, a (CVSS 7.5, Jenkins Project Jenkins Credentials Binding Plugin · org.je…)
- [CVE-2026-48921](https://cve.now/CVE-2026-48921.md): Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea\_a\_9b\_e45a\_0 and earlier does not prohibit symbolic links in shared libraries, allowing a (CVSS 7.5, Jenkins Project Jenkins Pipeline: Groovy Libraries Plugin ·…)
- [CVE-2026-48920](https://cve.now/CVE-2026-48920.md): Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as \`base64\` in email content by setting the \`data-inlin (CVSS 8.8, Jenkins Project Jenkins Email Extension Plugin · org.jenkin…)
- [CVE-2026-48919](https://cve.now/CVE-2026-48919.md): Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation. (CVSS 6.6, Jenkins Project Jenkins Active Directory Plugin · org.jenki…)
- [CVE-2026-48918](https://cve.now/CVE-2026-48918.md): Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default. (CVSS 6.6, Jenkins Project Jenkins Active Directory Plugin · org.jenki…)
- [CVE-2026-48917](https://cve.now/CVE-2026-48917.md): Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation. (CVSS 6.6, Jenkins Project Jenkins LDAP Plugin · org.jenkins-ci.plugin…)
- [CVE-2026-48916](https://cve.now/CVE-2026-48916.md): Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals. (CVSS 6.6, Jenkins Project Jenkins LDAP Plugin · org.jenkins-ci.plugin…)
- [CVE-2026-42525](https://cve.now/CVE-2026-42525.md): Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowi (CVSS 4.3, Jenkins Project Jenkins Microsoft Entra ID (previously Azur…)
- [CVE-2026-42524](https://cve.now/CVE-2026-42524.md): Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site (CVSS 8.0, Jenkins Project Jenkins HTML Publisher Plugin · org.jenkins…)
- [CVE-2026-42523](https://cve.now/CVE-2026-42523.md): Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the featu (CVSS 9.0, Jenkins Project Jenkins GitHub Plugin · com.coravy.hudson.p…)
- [CVE-2026-42522](https://cve.now/CVE-2026-42522.md): A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea\_d580c1a\_b\_a\_ and earlier allows attackers with Overall/Read perm (CVSS 4.3, Jenkins Project Jenkins GitHub Branch Source Plugin · org.j…)
- [CVE-2026-42521](https://cve.now/CVE-2026-42521.md): Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specifi (CVSS 6.5, Jenkins Project Jenkins Matrix Authorization Strategy Plugi…)
- [CVE-2026-42520](https://cve.now/CVE-2026-42520.md): Jenkins Credentials Binding Plugin 719.v80e905ef14eb\_ and earlier does not sanitize file names for file and zip file credentials, allowing a (CVSS 7.5, Jenkins Project Jenkins Credentials Binding Plugin · org.je…)
- [CVE-2026-42519](https://cve.now/CVE-2026-42519.md): A missing permission check in Jenkins Script Security Plugin 1399.ve6a\_66547f6e1 and earlier allows attackers with Overall/Read permission t (CVSS 4.3, Jenkins Project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2026-33004](https://cve.now/CVE-2026-33004.md): Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential (CVSS 4.3, Jenkins Project Jenkins LoadNinja Plugin · org.jenkins-ci.p…)
- [CVE-2026-33003](https://cve.now/CVE-2026-33003.md): Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they (CVSS 4.3, Jenkins Project Jenkins LoadNinja Plugin · org.jenkins-ci.p…)
- [CVE-2026-33002](https://cve.now/CVE-2026-33002.md): Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made t (CVSS 7.5, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-33001](https://cve.now/CVE-2026-33001.md): Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, (CVSS 8.8, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-27100](https://cve.now/CVE-2026-27100.md): Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-27099](https://cve.now/CVE-2026-27099.md): Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of (CVSS 8.0, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-67643](https://cve.now/CVE-2025-67643.md): Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b\_9517b\_6b\_202 and earlier does not correctly perform path validation of the work (CVSS 4.3, Jenkins Project Jenkins Redpen - Pipeline Reporter for Jira…)
- [CVE-2025-67642](https://cve.now/CVE-2025-67642.md): Jenkins HashiCorp Vault Plugin 371.v884a\_4dd60fb\_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing a (CVSS 4.3, Jenkins Project Jenkins HashiCorp Vault Plugin · com.datapi…)
- [CVE-2025-67641](https://cve.now/CVE-2025-67641.md): Jenkins Coverage Plugin 2.3054.ve1ff7b\_a\_a\_123b\_ and earlier does not validate the configured coverage results ID when creating coverage res (CVSS 8.0, Jenkins Project Jenkins Coverage Plugin · io.jenkins.plugin…)
- [CVE-2025-67640](https://cve.now/CVE-2025-67640.md): Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a te (CVSS 5.0, Jenkins Project Jenkins Git client Plugin · org.jenkins-ci.…)
- [CVE-2025-67639](https://cve.now/CVE-2025-67639.md): A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into (CVSS 3.5, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-67638](https://cve.now/CVE-2025-67638.md): Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increas (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-67637](https://cve.now/CVE-2025-67637.md): Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins cont (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-67636](https://cve.now/CVE-2025-67636.md): A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypte (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-67635](https://cve.now/CVE-2025-67635.md): Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes cor (CVSS 7.5, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-co… +1)
- [CVE-2025-64150](https://cve.now/CVE-2025-64150.md): A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect t (CVSS 5.4, Jenkins Project Jenkins Publish to Bitbucket Plugin · org.j…)
- [CVE-2025-64149](https://cve.now/CVE-2025-64149.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an a (CVSS 5.4, Jenkins Project Jenkins Publish to Bitbucket Plugin · org.j…)
- [CVE-2025-64148](https://cve.now/CVE-2025-64148.md): A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate (CVSS 4.3, Jenkins Project Jenkins Publish to Bitbucket Plugin · org.j…)
- [CVE-2025-64147](https://cve.now/CVE-2025-64147.md): Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attacke (CVSS 4.3, Jenkins Project Jenkins Curseforge Publisher Plugin · org.j…)
- [CVE-2025-64146](https://cve.now/CVE-2025-64146.md): Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be view (CVSS 4.3, Jenkins Project Jenkins Curseforge Publisher Plugin · org.j…)
- [CVE-2025-64145](https://cve.now/CVE-2025-64145.md): Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for at (CVSS 4.3, Jenkins Project Jenkins ByteGuard Build Actions Plugin · io…)
- [CVE-2025-64144](https://cve.now/CVE-2025-64144.md): Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be (CVSS 4.3, Jenkins Project Jenkins ByteGuard Build Actions Plugin · io…)
- [CVE-2025-64143](https://cve.now/CVE-2025-64143.md): Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controll (CVSS 4.3, Jenkins Project Jenkins OpenShift Pipeline Plugin · com.ope…)
- [CVE-2025-64142](https://cve.now/CVE-2025-64142.md): A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to (CVSS 4.3, Jenkins Project Jenkins Nexus Task Runner Plugin · org.jenk…)
- [CVE-2025-64141](https://cve.now/CVE-2025-64141.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an at (CVSS 4.3, Jenkins Project Jenkins Nexus Task Runner Plugin · org.jenk…)
- [CVE-2025-64140](https://cve.now/CVE-2025-64140.md): Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Ite (CVSS 8.8, Jenkins Project Jenkins Azure CLI Plugin · org.jenkins-ci.p…)
- [CVE-2025-64139](https://cve.now/CVE-2025-64139.md): A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to conn (CVSS 4.3, Jenkins Project Jenkins Start Windocks Containers Plugin ·…)
- [CVE-2025-64138](https://cve.now/CVE-2025-64138.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to (CVSS 4.3, Jenkins Project Jenkins Start Windocks Containers Plugin ·…)
- [CVE-2025-64137](https://cve.now/CVE-2025-64137.md): A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacke (CVSS 4.3, Jenkins Project Jenkins Themis Plugin · org.jenkins-ci.plug…)
- [CVE-2025-64136](https://cve.now/CVE-2025-64136.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-spec (CVSS 4.3, Jenkins Project Jenkins Themis Plugin · org.jenkins-ci.plug…)
- [CVE-2025-64135](https://cve.now/CVE-2025-64135.md): Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb\_8 and earlier sets the Java system property \`jdk.http.auth.tunneling.disabledSchemes\` (CVSS 5.9, Jenkins Project Jenkins Eggplant Runner Plugin · io.jenkins…)
- [CVE-2025-64134](https://cve.now/CVE-2025-64134.md): Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prev (CVSS 7.1, Jenkins Project Jenkins JDepend Plugin · org.jenkins-ci.plu…)
- [CVE-2025-64133](https://cve.now/CVE-2025-64133.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attacke (CVSS 5.4, Jenkins Project Jenkins Extensible Choice Parameter Plugin…)
- [CVE-2025-64132](https://cve.now/CVE-2025-64132.md): Jenkins MCP Server Plugin 0.84.v50ca\_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to tr (CVSS 5.4, Jenkins Project Jenkins MCP Server Plugin · io.jenkins.plug…)
- [CVE-2025-64131](https://cve.now/CVE-2025-64131.md): Jenkins SAML Plugin 4.583.vc68232f7018a\_ and earlier does not implement a replay cache, allowing attackers able to obtain information about (CVSS 7.5, Jenkins Project Jenkins SAML Plugin · org.jenkins-ci.plugin…)
- [CVE-2025-59476](https://cve.now/CVE-2025-59476.md): Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified co (CVSS 5.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-59475](https://cve.now/CVE-2025-59475.md): Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, all (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-59474](https://cve.now/CVE-2025-59474.md): Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible t (CVSS 5.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-58460](https://cve.now/CVE-2025-58460.md): A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b\_92b\_cd64 and earlier allows attackers with Overall/Read permission (CVSS 4.2, Jenkins Project Jenkins OpenTelemetry Plugin · io.jenkins.p…)
- [CVE-2025-58459](https://cve.now/CVE-2025-58459.md): Jenkins global-build-stats Plugin 322.v22f4db\_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing atta (CVSS 4.3, Jenkins Project Jenkins global-build-stats Plugin · org.jen…)
- [CVE-2025-58458](https://cve.now/CVE-2025-58458.md): In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the (CVSS 4.3, Jenkins Project Jenkins Git client Plugin · org.jenkins-ci.…)
- [CVE-2025-53743](https://cve.now/CVE-2025-53743.md): Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the (CVSS 5.3, Jenkins Project Jenkins Applitools Eyes Plugin · org.jenkin…)
- [CVE-2025-53742](https://cve.now/CVE-2025-53742.md): Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, (CVSS 6.5, Jenkins Project Jenkins Applitools Eyes Plugin · org.jenkin…)
- [CVE-2025-53678](https://cve.now/CVE-2025-53678.md): Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins cont (CVSS 6.5, Jenkins Project Jenkins User1st uTester Plugin · io.jenkins…)
- [CVE-2025-53677](https://cve.now/CVE-2025-53677.md): Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for (CVSS 5.3, Jenkins Project Jenkins Xooa Plugin · io.jenkins.plugins:xo…)
- [CVE-2025-53676](https://cve.now/CVE-2025-53676.md): Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controlle (CVSS 6.5, Jenkins Project Jenkins Xooa Plugin · io.jenkins.plugins:xo…)
- [CVE-2025-53675](https://cve.now/CVE-2025-53675.md): Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they (CVSS 6.5, Jenkins Project Jenkins Warrior Framework Plugin · org.jenk…)
- [CVE-2025-53674](https://cve.now/CVE-2025-53674.md): Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, in (CVSS 5.3, Jenkins Project Jenkins Sensedia Api Platform tools Plugin…)
- [CVE-2025-53673](https://cve.now/CVE-2025-53673.md): Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration fil (CVSS 6.5, Jenkins Project Jenkins Sensedia Api Platform tools Plugin…)
- [CVE-2025-53672](https://cve.now/CVE-2025-53672.md): Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controll (CVSS 6.5, Jenkins Project Jenkins Kryptowire Plugin · io.jenkins.plug…)
- [CVE-2025-53671](https://cve.now/CVE-2025-53671.md): Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job conf (CVSS 6.5, Jenkins Project Jenkins Nouvola DiveCloud Plugin · org.jenk…)
- [CVE-2025-53670](https://cve.now/CVE-2025-53670.md): Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml fi (CVSS 6.5, Jenkins Project Jenkins Nouvola DiveCloud Plugin · org.jenk…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/jenkins
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.