# cve.now: Jenkins Project

The newest entries naming Jenkins Project as an affected vendor (up to 200), of 1,613 in all, 3 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-117626](https://cve.now/CVE-2026-117626.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for… (CVSS 4.3)
- [CVE-2026-117625](https://cve.now/CVE-2026-117625.md): A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain… (CVSS 4.3)
- [CVE-2026-117624](https://cve.now/CVE-2026-117624.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked… (CVSS 8.8)
- [CVE-2026-117623](https://cve.now/CVE-2026-117623.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries… (CVSS 5.4)
- [CVE-2026-117622](https://cve.now/CVE-2026-117622.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the… (CVSS 6.1)
- [CVE-2026-117621](https://cve.now/CVE-2026-117621.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file… (CVSS 6.1)
- [CVE-2026-117620](https://cve.now/CVE-2026-117620.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old… (CVSS 8.8)
- [CVE-2026-117619](https://cve.now/CVE-2026-117619.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API… (CVSS 8.1)
- [CVE-2026-117618](https://cve.now/CVE-2026-117618.md): In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the… (CVSS 8.1)
- [CVE-2026-117617](https://cve.now/CVE-2026-117617.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its… (CVSS 8.1)
- [CVE-2026-117616](https://cve.now/CVE-2026-117616.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name… (CVSS 8.8)
- [CVE-2026-117615](https://cve.now/CVE-2026-117615.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing… (CVSS 6.5)
- [CVE-2026-117614](https://cve.now/CVE-2026-117614.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by… (CVSS 8.8)
- [CVE-2026-117613](https://cve.now/CVE-2026-117613.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers… (CVSS 5.4)
- [CVE-2026-117612](https://cve.now/CVE-2026-117612.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the \`resolves-to\`… (CVSS 8.8)
- [CVE-2026-92141](https://cve.now/CVE-2026-92141.md): Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phish (CVSS 4.3)
- [CVE-2026-92140](https://cve.now/CVE-2026-92140.md): Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, result (CVSS 6.8)
- [CVE-2026-92139](https://cve.now/CVE-2026-92139.md): Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and (CVSS 6.5)
- [CVE-2026-92138](https://cve.now/CVE-2026-92138.md): The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the \`oauth\_callback\` URL from the su (CVSS 4.2)
- [CVE-2026-92137](https://cve.now/CVE-2026-92137.md): Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is co (CVSS 8.8)
- [CVE-2026-92136](https://cve.now/CVE-2026-92136.md): Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resultin (CVSS 8.0)
- [CVE-2026-92135](https://cve.now/CVE-2026-92135.md): Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted thr (CVSS 8.0)
- [CVE-2026-92134](https://cve.now/CVE-2026-92134.md): Jenkins Warnings Plugin 13.10258.va\_17d49a\_78c3b\_ and earlier does not validate the analysis results ID when a job configuration is submitte (CVSS 8.0)
- [CVE-2026-92133](https://cve.now/CVE-2026-92133.md): Jenkins GitLab Plugin 1.2149.vcfc32c82b\_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials unde (CVSS 5.4)
- [CVE-2026-92132](https://cve.now/CVE-2026-92132.md): Jenkins Gradle Plugin 2.19.1252.v15196b\_5a\_6e10 and earlier requests build scan data from the build scan link detected in the build log, eve (CVSS 5.4)
- [CVE-2026-92131](https://cve.now/CVE-2026-92131.md): Jenkins Pipeline: Groovy Libraries Plugin 805.va\_fc79344957d and earlier does not restrict the library path provided to the library Pipeline (CVSS 4.2)
- [CVE-2026-92130](https://cve.now/CVE-2026-92130.md): Jenkins Pipeline: Multibranch Plugin 841.vec5b\_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resol (CVSS 3.1)
- [CVE-2026-92129](https://cve.now/CVE-2026-92129.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to (CVSS 7.5)
- [CVE-2026-92128](https://cve.now/CVE-2026-92128.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the (CVSS 7.5)
- [CVE-2026-92127](https://cve.now/CVE-2026-92127.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier automatically approves the classpath entries in an item configuration when (CVSS 8.0)
- [CVE-2026-92126](https://cve.now/CVE-2026-92126.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an (CVSS 7.2)
- [CVE-2026-92125](https://cve.now/CVE-2026-92125.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing atta (CVSS 8.8)
- [CVE-2026-92124](https://cve.now/CVE-2026-92124.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier checks the operations Groovy will perform with the elements it reads from a (CVSS 8.8)
- [CVE-2026-92123](https://cve.now/CVE-2026-92123.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier does not intercept operations performed on a null receiver (method calls, p (CVSS 8.8)
- [CVE-2026-92122](https://cve.now/CVE-2026-92122.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier does not check the method called through the proxy created when a sandboxed (CVSS 8.8)
- [CVE-2026-84677](https://cve.now/CVE-2026-84677.md): Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugi (CVSS 5.4)
- [CVE-2026-84676](https://cve.now/CVE-2026-84676.md): Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller wh (CVSS 4.3)
- [CVE-2026-84675](https://cve.now/CVE-2026-84675.md): OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable v (CVSS 7.4)
- [CVE-2026-84674](https://cve.now/CVE-2026-84674.md): Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate (CVSS 5.4)
- [CVE-2026-84673](https://cve.now/CVE-2026-84673.md): Jenkins Customizable Header Plugin 295.v2544b\_ca\_19b\_97 and earlier allows overwriting the plugin's appearance configuration through Stapler (CVSS 8.8)
- [CVE-2026-84672](https://cve.now/CVE-2026-84672.md): Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b\_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's (CVSS 8.8)
- [CVE-2026-84671](https://cve.now/CVE-2026-84671.md): Jenkins File Parameter Plugin 425.v3fa\_801681b\_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file sys (CVSS 8.8)
- [CVE-2026-84670](https://cve.now/CVE-2026-84670.md): Jenkins Performance Plugin 1015.v09ca\_52b\_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached (CVSS 8.8)
- [CVE-2026-84669](https://cve.now/CVE-2026-84669.md): A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish A (CVSS 8.8)
- [CVE-2026-84668](https://cve.now/CVE-2026-84668.md): Jenkins SAML Plugin 4.618.v441a\_27fa\_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data bindi (CVSS 8.8)
- [CVE-2026-84667](https://cve.now/CVE-2026-84667.md): Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing atta (CVSS 7.1)
- [CVE-2026-84666](https://cve.now/CVE-2026-84666.md): Jenkins Job Configuration History Plugin 1367.vc8fa\_b\_15101dc and earlier allows overwriting the plugin's history recording configuration th (CVSS 5.4)
- [CVE-2026-84665](https://cve.now/CVE-2026-84665.md): Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner (CVSS 8.0)
- [CVE-2026-84664](https://cve.now/CVE-2026-84664.md): Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowin (CVSS 5.4)
- [CVE-2026-84663](https://cve.now/CVE-2026-84663.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attacker (CVSS 5.4)
- [CVE-2026-84662](https://cve.now/CVE-2026-84662.md): Jenkins LDAP Plugin 807.809.vd3a\_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers (CVSS 4.3)
- [CVE-2026-84661](https://cve.now/CVE-2026-84661.md): A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b\_67ea\_11b\_152 and earlier causes downstream builds awaited by the \` (CVSS 5.4)
- [CVE-2026-84660](https://cve.now/CVE-2026-84660.md): A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b\_67ea\_11b\_152 and earlier causes downstream builds triggered by the (CVSS 5.4)
- [CVE-2026-84659](https://cve.now/CVE-2026-84659.md): Jenkins Script Security Plugin 1412.v7737b\_3405f86 and earlier does not enforce a permission check in the method that controls the "Force th (CVSS 4.3)
- [CVE-2026-84658](https://cve.now/CVE-2026-84658.md): Jenkins Script Security Plugin 1412.v7737b\_3405f86 and earlier uses the \`@DataBoundConstructor\` annotation on a constructor that loads scrip (CVSS 4.3)
- [CVE-2026-84657](https://cve.now/CVE-2026-84657.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s fla (CVSS 4.2)
- [CVE-2026-84656](https://cve.now/CVE-2026-84656.md): A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one (CVSS 4.3)
- [CVE-2026-84655](https://cve.now/CVE-2026-84655.md): Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API (CVSS 4.3)
- [CVE-2026-84654](https://cve.now/CVE-2026-84654.md): In Stapler 2107.v8dfcb\_e8ed317 and earlier, except 2088.2093.vd7c3e58008a\_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, (CVSS 5.4)
- [CVE-2026-84653](https://cve.now/CVE-2026-84653.md): Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in t (CVSS 3.5)
- [CVE-2026-84652](https://cve.now/CVE-2026-84652.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me (CVSS 7.3)
- [CVE-2026-84651](https://cve.now/CVE-2026-84651.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a subm (CVSS 6.3)
- [CVE-2026-84650](https://cve.now/CVE-2026-84650.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to (CVSS 8.8)
- [CVE-2026-84649](https://cve.now/CVE-2026-84649.md): In Stapler 1839.ved17667b\_a\_eb\_5 through 2107.v8dfcb\_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a\_6, included in Jenkins 2.447 th (CVSS 8.8)
- [CVE-2026-84648](https://cve.now/CVE-2026-84648.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timesta (CVSS 8.8)
- [CVE-2026-84647](https://cve.now/CVE-2026-84647.md): In Stapler 2107.v8dfcb\_e8ed317 and earlier, except 2088.2093.vd7c3e58008a\_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, (CVSS 8.8)
- [CVE-2026-84646](https://cve.now/CVE-2026-84646.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, all (CVSS 4.3)
- [CVE-2026-84645](https://cve.now/CVE-2026-84645.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level confi (CVSS 8.8)
- [CVE-2026-70448](https://cve.now/CVE-2026-70448.md): Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing Ivy (CVSS 7.1)
- [CVE-2026-70447](https://cve.now/CVE-2026-70447.md): Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credent (CVSS 4.3)
- [CVE-2026-70446](https://cve.now/CVE-2026-70446.md): Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credential (CVSS 4.3)
- [CVE-2026-70445](https://cve.now/CVE-2026-70445.md): Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate crede (CVSS 4.3)
- [CVE-2026-70444](https://cve.now/CVE-2026-70444.md): A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission t (CVSS 4.3)
- [CVE-2026-70443](https://cve.now/CVE-2026-70443.md): Jenkins Horreum Plugin 0.16.162.v33b\_4a\_a\_b\_5f828 and earlier does not set the appropriate context for credentials lookup, allowing attacker (CVSS 4.3)
- [CVE-2026-70442](https://cve.now/CVE-2026-70442.md): Jenkins Google Chat Notification Plugin 166.ve6b\_de280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing (CVSS 4.3)
- [CVE-2026-70441](https://cve.now/CVE-2026-70441.md): Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a s (CVSS 5.4)
- [CVE-2026-70440](https://cve.now/CVE-2026-70440.md): Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, (CVSS 5.4)
- [CVE-2026-70439](https://cve.now/CVE-2026-70439.md): Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions (CVSS 6.5)
- [CVE-2026-70438](https://cve.now/CVE-2026-70438.md): A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to (CVSS 4.3)
- [CVE-2026-70437](https://cve.now/CVE-2026-70437.md): Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa\_f0215cf5 and earlier does not use a constant-time comparison function when check (CVSS 3.7)
- [CVE-2026-70436](https://cve.now/CVE-2026-70436.md): Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper (CVSS 4.3)
- [CVE-2026-70435](https://cve.now/CVE-2026-70435.md): A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an a (CVSS 4.2)
- [CVE-2026-70434](https://cve.now/CVE-2026-70434.md): A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacke (CVSS 4.2)
- [CVE-2026-70433](https://cve.now/CVE-2026-70433.md): Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credenti (CVSS 4.3)
- [CVE-2026-70432](https://cve.now/CVE-2026-70432.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a\_d9c71b\_0 and earlier allows attackers to execute arb (CVSS 8.8)
- [CVE-2026-70431](https://cve.now/CVE-2026-70431.md): Jenkins Multijob Plugin 669.v9d96a\_d9c71b\_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin (CVSS 8.8)
- [CVE-2026-70430](https://cve.now/CVE-2026-70430.md): Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project na (CVSS 2.7)
- [CVE-2026-70429](https://cve.now/CVE-2026-70429.md): Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attacke (CVSS 8.1)
- [CVE-2026-70428](https://cve.now/CVE-2026-70428.md): Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allow (CVSS 4.3)
- [CVE-2026-70427](https://cve.now/CVE-2026-70427.md): Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction (CVSS 4.3)
- [CVE-2026-70426](https://cve.now/CVE-2026-70426.md): In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, (CVSS 9.0)
- [CVE-2026-57307](https://cve.now/CVE-2026-57307.md): A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b\_450b\_1 and earlier allows attackers with Overall/Read permission (CVSS 4.2)
- [CVE-2026-57306](https://cve.now/CVE-2026-57306.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b\_450b\_1 and earlier allows attackers to co (CVSS 4.2)
- [CVE-2026-57305](https://cve.now/CVE-2026-57305.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-spec (CVSS 5.4)
- [CVE-2026-57304](https://cve.now/CVE-2026-57304.md): A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacke (CVSS 5.4)
- [CVE-2026-57303](https://cve.now/CVE-2026-57303.md): Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers a (CVSS 7.1)
- [CVE-2026-57302](https://cve.now/CVE-2026-57302.md): Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be v (CVSS 4.3)
- [CVE-2026-57301](https://cve.now/CVE-2026-57301.md): Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing atta (CVSS 8.8)
- [CVE-2026-57300](https://cve.now/CVE-2026-57300.md): A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb\_2557fe and earlier allows attackers with Item/Read permission to read (CVSS 4.3)
- [CVE-2026-57299](https://cve.now/CVE-2026-57299.md): Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read perm (CVSS 4.3)
- [CVE-2026-57298](https://cve.now/CVE-2026-57298.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attacke (CVSS 5.4)
- [CVE-2026-57297](https://cve.now/CVE-2026-57297.md): A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read pe (CVSS 5.4)
- [CVE-2026-57296](https://cve.now/CVE-2026-57296.md): Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided t (CVSS 8.8)
- [CVE-2026-57295](https://cve.now/CVE-2026-57295.md): A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a\_81c3 and earlier allows attackers to conne (CVSS 5.4)
- [CVE-2026-57294](https://cve.now/CVE-2026-57294.md): A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a\_81c3 and earlier allows attackers with Overall/Read permission to (CVSS 5.4)
- [CVE-2026-57293](https://cve.now/CVE-2026-57293.md): An incorrect permission check in Jenkins Gitee Plugin 1288.v18b\_deb\_c9069b\_ and earlier allows attackers with global Item/Configure permissi (CVSS 4.3)
- [CVE-2026-57292](https://cve.now/CVE-2026-57292.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b\_deb\_c9069b\_ and earlier allows attackers to connect to a (CVSS 5.4)
- [CVE-2026-57291](https://cve.now/CVE-2026-57291.md): Missing permission checks in Jenkins Gitee Plugin 1288.v18b\_deb\_c9069b\_ and earlier allow attackers with Overall/Read permission to connect (CVSS 5.4)
- [CVE-2026-57290](https://cve.now/CVE-2026-57290.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b\_84449 and earlier allows attackers to overw (CVSS 4.3)
- [CVE-2026-57289](https://cve.now/CVE-2026-57289.md): Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for co (CVSS 4.8)
- [CVE-2026-57288](https://cve.now/CVE-2026-57288.md): Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows nativ (CVSS 3.7)
- [CVE-2026-57287](https://cve.now/CVE-2026-57287.md): Jenkins Job Configuration History Plugin 1356.ve360da\_6c523a\_ and earlier does not redact the encrypted values of secrets when displaying hi (CVSS 4.3)
- [CVE-2026-57286](https://cve.now/CVE-2026-57286.md): A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca\_ and earlier allows attackers with Item/Read permission to obta (CVSS 4.3)
- [CVE-2026-57285](https://cve.now/CVE-2026-57285.md): A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read per (CVSS 4.3)
- [CVE-2026-57284](https://cve.now/CVE-2026-57284.md): Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Sni (CVSS 4.3)
- [CVE-2026-57283](https://cve.now/CVE-2026-57283.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to inst (CVSS 4.3)
- [CVE-2026-57282](https://cve.now/CVE-2026-57282.md): Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH (CVSS 5.0)
- [CVE-2026-57281](https://cve.now/CVE-2026-57281.md): Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions m (CVSS 7.5)
- [CVE-2026-57280](https://cve.now/CVE-2026-57280.md): Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed fo (CVSS 8.8)
- [CVE-2026-53442](https://cve.now/CVE-2026-53442.md): Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job conf (CVSS 5.3)
- [CVE-2026-53441](https://cve.now/CVE-2026-53441.md): Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of (CVSS 5.4)
- [CVE-2026-53440](https://cve.now/CVE-2026-53440.md): Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security (CVSS 4.3)
- [CVE-2026-53439](https://cve.now/CVE-2026-53439.md): Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine ot (CVSS 4.3)
- [CVE-2026-53438](https://cve.now/CVE-2026-53438.md): A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking I (CVSS 4.3)
- [CVE-2026-53437](https://cve.now/CVE-2026-53437.md): Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins (CVSS 4.3)
- [CVE-2026-53436](https://cve.now/CVE-2026-53436.md): Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins (CVSS 4.3)
- [CVE-2026-53435](https://cve.now/CVE-2026-53435.md): In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in J (CVSS 8.8)
- [CVE-2026-9674](https://cve.now/CVE-2026-9674.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b\_b\_d and earlier allows attackers to resume fail (CVSS 4.3)
- [CVE-2026-48927](https://cve.now/CVE-2026-48927.md): Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerability (CVSS 5.5)
- [CVE-2026-48926](https://cve.now/CVE-2026-48926.md): Jenkins Job Import Plugin 143.v044a\_2e819b\_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with O (CVSS 4.3)
- [CVE-2026-48925](https://cve.now/CVE-2026-48925.md): A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to tr (CVSS 4.3)
- [CVE-2026-48924](https://cve.now/CVE-2026-48924.md): Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attac (CVSS 4.3)
- [CVE-2026-48923](https://cve.now/CVE-2026-48923.md): Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers (CVSS 4.3)
- [CVE-2026-48922](https://cve.now/CVE-2026-48922.md): Jenkins Credentials Binding Plugin 720.v3f6decef43ea\_ and earlier does not properly sanitize file names for file and zip file credentials, a (CVSS 7.5)
- [CVE-2026-48921](https://cve.now/CVE-2026-48921.md): Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea\_a\_9b\_e45a\_0 and earlier does not prohibit symbolic links in shared libraries, allowing a (CVSS 7.5)
- [CVE-2026-48920](https://cve.now/CVE-2026-48920.md): Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as \`base64\` in email content by setting the \`data-inlin (CVSS 8.8)
- [CVE-2026-48919](https://cve.now/CVE-2026-48919.md): Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation. (CVSS 6.6)
- [CVE-2026-48918](https://cve.now/CVE-2026-48918.md): Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default. (CVSS 6.6)
- [CVE-2026-48917](https://cve.now/CVE-2026-48917.md): Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation. (CVSS 6.6)
- [CVE-2026-48916](https://cve.now/CVE-2026-48916.md): Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals. (CVSS 6.6)
- [CVE-2026-42525](https://cve.now/CVE-2026-42525.md): Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowi (CVSS 4.3)
- [CVE-2026-42524](https://cve.now/CVE-2026-42524.md): Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site (CVSS 8.0)
- [CVE-2026-42523](https://cve.now/CVE-2026-42523.md): Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the featu (CVSS 9.0)
- [CVE-2026-42522](https://cve.now/CVE-2026-42522.md): A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea\_d580c1a\_b\_a\_ and earlier allows attackers with Overall/Read perm (CVSS 4.3)
- [CVE-2026-42521](https://cve.now/CVE-2026-42521.md): Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specifi (CVSS 6.5)
- [CVE-2026-42520](https://cve.now/CVE-2026-42520.md): Jenkins Credentials Binding Plugin 719.v80e905ef14eb\_ and earlier does not sanitize file names for file and zip file credentials, allowing a (CVSS 7.5)
- [CVE-2026-42519](https://cve.now/CVE-2026-42519.md): A missing permission check in Jenkins Script Security Plugin 1399.ve6a\_66547f6e1 and earlier allows attackers with Overall/Read permission t (CVSS 4.3)
- [CVE-2026-33004](https://cve.now/CVE-2026-33004.md): Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential (CVSS 4.3)
- [CVE-2026-33003](https://cve.now/CVE-2026-33003.md): Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they (CVSS 4.3)
- [CVE-2026-33002](https://cve.now/CVE-2026-33002.md): Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made t (CVSS 7.5)
- [CVE-2026-33001](https://cve.now/CVE-2026-33001.md): Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, (CVSS 8.8)
- [CVE-2026-27100](https://cve.now/CVE-2026-27100.md): Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not (CVSS 4.3)
- [CVE-2026-27099](https://cve.now/CVE-2026-27099.md): Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of (CVSS 8.0)
- [CVE-2025-67643](https://cve.now/CVE-2025-67643.md): Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b\_9517b\_6b\_202 and earlier does not correctly perform path validation of the work (CVSS 4.3)
- [CVE-2025-67642](https://cve.now/CVE-2025-67642.md): Jenkins HashiCorp Vault Plugin 371.v884a\_4dd60fb\_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing a (CVSS 4.3)
- [CVE-2025-67641](https://cve.now/CVE-2025-67641.md): Jenkins Coverage Plugin 2.3054.ve1ff7b\_a\_a\_123b\_ and earlier does not validate the configured coverage results ID when creating coverage res (CVSS 8.0)
- [CVE-2025-67640](https://cve.now/CVE-2025-67640.md): Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a te (CVSS 5.0)
- [CVE-2025-67639](https://cve.now/CVE-2025-67639.md): A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into (CVSS 3.5)
- [CVE-2025-67638](https://cve.now/CVE-2025-67638.md): Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increas (CVSS 4.3)
- [CVE-2025-67637](https://cve.now/CVE-2025-67637.md): Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins cont (CVSS 4.3)
- [CVE-2025-67636](https://cve.now/CVE-2025-67636.md): A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypte (CVSS 4.3)
- [CVE-2025-67635](https://cve.now/CVE-2025-67635.md): Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes cor (CVSS 7.5)
- [CVE-2025-64150](https://cve.now/CVE-2025-64150.md): A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect t (CVSS 5.4)
- [CVE-2025-64149](https://cve.now/CVE-2025-64149.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an a (CVSS 5.4)
- [CVE-2025-64148](https://cve.now/CVE-2025-64148.md): A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate (CVSS 4.3)
- [CVE-2025-64147](https://cve.now/CVE-2025-64147.md): Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attacke (CVSS 4.3)
- [CVE-2025-64146](https://cve.now/CVE-2025-64146.md): Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be view (CVSS 4.3)
- [CVE-2025-64145](https://cve.now/CVE-2025-64145.md): Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for at (CVSS 4.3)
- [CVE-2025-64144](https://cve.now/CVE-2025-64144.md): Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be (CVSS 4.3)
- [CVE-2025-64143](https://cve.now/CVE-2025-64143.md): Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controll (CVSS 4.3)
- [CVE-2025-64142](https://cve.now/CVE-2025-64142.md): A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to (CVSS 4.3)
- [CVE-2025-64141](https://cve.now/CVE-2025-64141.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an at (CVSS 4.3)
- [CVE-2025-64140](https://cve.now/CVE-2025-64140.md): Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Ite (CVSS 8.8)
- [CVE-2025-64139](https://cve.now/CVE-2025-64139.md): A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to conn (CVSS 4.3)
- [CVE-2025-64138](https://cve.now/CVE-2025-64138.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to (CVSS 4.3)
- [CVE-2025-64137](https://cve.now/CVE-2025-64137.md): A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacke (CVSS 4.3)
- [CVE-2025-64136](https://cve.now/CVE-2025-64136.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-spec (CVSS 4.3)
- [CVE-2025-64135](https://cve.now/CVE-2025-64135.md): Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb\_8 and earlier sets the Java system property \`jdk.http.auth.tunneling.disabledSchemes\` (CVSS 5.9)
- [CVE-2025-64134](https://cve.now/CVE-2025-64134.md): Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prev (CVSS 7.1)
- [CVE-2025-64133](https://cve.now/CVE-2025-64133.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attacke (CVSS 5.4)
- [CVE-2025-64132](https://cve.now/CVE-2025-64132.md): Jenkins MCP Server Plugin 0.84.v50ca\_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to tr (CVSS 5.4)
- [CVE-2025-64131](https://cve.now/CVE-2025-64131.md): Jenkins SAML Plugin 4.583.vc68232f7018a\_ and earlier does not implement a replay cache, allowing attackers able to obtain information about (CVSS 7.5)
- [CVE-2025-59476](https://cve.now/CVE-2025-59476.md): Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified co (CVSS 5.3)
- [CVE-2025-59475](https://cve.now/CVE-2025-59475.md): Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, all (CVSS 4.3)
- [CVE-2025-59474](https://cve.now/CVE-2025-59474.md): Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible t (CVSS 5.3)
- [CVE-2025-58460](https://cve.now/CVE-2025-58460.md): A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b\_92b\_cd64 and earlier allows attackers with Overall/Read permission (CVSS 4.2)
- [CVE-2025-58459](https://cve.now/CVE-2025-58459.md): Jenkins global-build-stats Plugin 322.v22f4db\_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing atta (CVSS 4.3)
- [CVE-2025-58458](https://cve.now/CVE-2025-58458.md): In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the (CVSS 4.3)
- [CVE-2025-53743](https://cve.now/CVE-2025-53743.md): Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the (CVSS 5.3)
- [CVE-2025-53742](https://cve.now/CVE-2025-53742.md): Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, (CVSS 6.5)
- [CVE-2025-53678](https://cve.now/CVE-2025-53678.md): Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins cont (CVSS 6.5)
- [CVE-2025-53677](https://cve.now/CVE-2025-53677.md): Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for (CVSS 5.3)
- [CVE-2025-53676](https://cve.now/CVE-2025-53676.md): Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controlle (CVSS 6.5)
- [CVE-2025-53675](https://cve.now/CVE-2025-53675.md): Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they (CVSS 6.5)
- [CVE-2025-53674](https://cve.now/CVE-2025-53674.md): Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, in (CVSS 5.3)
- [CVE-2025-53673](https://cve.now/CVE-2025-53673.md): Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration fil (CVSS 6.5)
- [CVE-2025-53672](https://cve.now/CVE-2025-53672.md): Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controll (CVSS 6.5)
- [CVE-2025-53671](https://cve.now/CVE-2025-53671.md): Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job conf (CVSS 6.5)
- [CVE-2025-53670](https://cve.now/CVE-2025-53670.md): Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml fi (CVSS 6.5)
- [CVE-2025-53669](https://cve.now/CVE-2025-53669.md): Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential f (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/jenkins-project
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.