InfraGuard
Sign in Try it now Buy now

Jenkins vulnerabilities (CVE list)

294 CVEs5 KEV9.8 max CVSS
Check your versioncurl -sI http://127.0.0.1:8080/ (X-Jenkins) || java -jar jenkins.war --version

Affected version lines

Known vulnerabilities

CVE Title Affected versions CVSS Exploited EPSS Published
CVE-2024-23897 Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that r... < 2.426.3 < 2.442 9.8 KEV 100.0% 2024-01-24
CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can... ≤ 2.414.2 ≤ 2.427 7.5 KEV 100.0% 2023-10-10
CVE-2018-1000861 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.13... ≤ 2.138.3 ≤ 2.153 9.8 KEV 98.3% 2018-12-10
CVE-2017-1000353 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remot... ≤ 2.56 ≤ 2.46.1 9.8 KEV 99.7% 2018-01-29
CVE-2015-5317 The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain s... ≤ 1.637 ≤ 1.625.1 7.5 KEV 23.0% 2015-11-25
CVE-2026-117617 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file... < 2.580.2 < 2.588 8.1 — 2026-10-28
CVE-2026-117618 In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account d... < 2.580.2 < 2.588 8.1 — 2026-10-28
CVE-2026-117619 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authenticati... < 2.580.2 < 2.588 8.1 — 2026-10-28
CVE-2026-117620 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger wa... < 2.580.2 < 2.588 8.8 — 2026-10-28
CVE-2026-117621 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the work... < 2.580.2 < 2.588 6.1 — 2026-10-28
CVE-2026-117622 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler H... < 2.580.2 < 2.588 6.1 — 2026-10-28
CVE-2026-117623 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrum... < 2.580.2 < 2.588 5.4 — 2026-10-28
CVE-2026-117624 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializ... < 2.580.2 < 2.588 8.8 — 2026-10-28
CVE-2026-117612 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes refere... < 2.580.2 < 2.588 8.8 — 2026-10-28
CVE-2026-117613 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deseriali... < 2.580.2 < 2.588 5.4 — 2026-10-28
CVE-2026-117614 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations... < 2.580.2 < 2.588 8.8 — 2026-10-28
CVE-2026-117615 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an ite... < 2.580.2 < 2.588 6.5 — 2026-10-28
CVE-2026-117616 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without... < 2.580.2 < 2.588 8.8 — 2026-10-28
CVE-2026-84655 Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON a... ≤ 2.568.2 ≤ 2.579 4.3 — 2026-09-02
CVE-2026-84656 A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Re... ≤ 2.568.2 ≤ 2.579 4.3 — 2026-09-02
CVE-2026-84657 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel pe... ≤ 2.568.2 ≤ 2.579 4.2 — 2026-09-02
CVE-2026-84645 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration... < 2.568.3 < 2.580 8.8 — 2026-09-02
CVE-2026-84646 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other... < 2.568.3 < 2.580 4.3 — 2026-09-02
CVE-2026-84648 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metada... < 2.568.3 < 2.580 8.8 — 2026-09-02
CVE-2026-84650 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserializatio... < 2.568.3 < 2.580 8.8 — 2026-09-02
CVE-2026-84651 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent confi... < 2.568.3 < 2.580 6.3 — 2026-09-02
CVE-2026-84652 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is auth... < 2.568.3 < 2.580 7.3 — 2026-09-02
CVE-2026-84653 Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly... ≥ 2.421 ≤ 2.579 ≥ 2.426.1 ≤ 2.568.2 3.5 — 2026-09-02
CVE-2026-70427 Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empt... < 2.568.2 < 2.576 4.3 — 2026-08-05
CVE-2026-70428 Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal... < 2.568.2 < 2.576 4.3 — 2026-08-05
CVE-2026-70429 Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names in... < 2.568.2 < 2.576 6.5 — 2026-08-05
CVE-2026-70430 Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instanti... < 2.568.2 < 2.576 2.7 — 2026-08-05
CVE-2026-53441 Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the... ≥ 2.483 < 2.568 ≥ 2.492.1 < 2.555.3 5.4 — 2026-06-10
CVE-2026-53442 Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions b... < 2.555.3 < 2.568 5.3 — 2026-06-10
CVE-2026-53435 In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserializ... < 2.555.3 < 2.568 8.8 — 2026-06-10
CVE-2026-53436 Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is le... < 2.555.3 < 2.568 4.3 — 2026-06-10
CVE-2026-53437 Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is le... < 2.555.3 < 2.568 4.3 — 2026-06-10
CVE-2026-53438 A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Ca... < 2.555.3 < 2.568 4.3 — 2026-06-10
CVE-2026-53439 Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/R... < 2.555.3 < 2.568 4.3 — 2026-06-10
CVE-2026-53440 Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate... < 2.555.3 < 2.568 4.3 — 2026-06-10
CVE-2026-33001 Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction... < 2.541.3 < 2.555 8.8 — 2026-03-18
CVE-2026-33002 Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin... ≥ 2.426.3 < 2.541.3 ≥ 2.442 < 2.555 7.5 — 2026-03-18
CVE-2026-27099 Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the... ≥ 2.483 < 2.551 ≥ 2.492.1 < 2.541.2 8.0 — 2026-02-18
CVE-2026-27100 Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user... < 2.541.2 < 2.551 4.3 — 2026-02-18
CVE-2025-67636 A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Re... < 2.528.3 < 2.541 4.3 — 2025-12-10
CVE-2025-67637 Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config... < 2.528.3 < 2.541 4.3 — 2025-12-10
CVE-2025-67638 Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the j... < 2.528.3 < 2.541 4.3 — 2025-12-10
CVE-2025-67639 A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows... < 2.528.3 < 2.541 3.5 — 2025-12-10
CVE-2025-67635 Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the... < 2.528.3 < 2.541 7.5 — 2025-12-10
CVE-2025-59474 Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a p... < 2.516.3 < 2.528 5.3 — 2025-09-17
CVE-2025-59475 Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated u... < 2.516.3 < 2.528 4.3 — 2025-09-17
CVE-2025-59476 Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be i... < 2.516.3 < 2.528 5.3 — 2025-09-17
CVE-2024-9453 Jenkins-image: sensitive data disclosure when using openshift jenkins image * 6.5 — 2025-07-04
CVE-2025-31720 A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Compute... < 2.492.3 < 2.504 4.3 — 2025-04-02
CVE-2025-31721 A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Compute... < 2.492.3 < 2.504 4.3 — 2025-04-02
CVE-2025-27623 Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing... < 2.492.2 < 2.500 4.3 — 2025-03-05
CVE-2025-27624 A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows... < 2.492.2 < 2.500 5.4 — 2025-03-05
CVE-2025-27625 In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are... < 2.492.2 < 2.500 4.3 — 2025-03-05
CVE-2025-27622 Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing... < 2.492.2 < 2.500 4.3 — 2025-03-05
CVE-2024-47803 Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages... < 2.462.3 < 2.479 4.3 — 2024-10-02
Official website

Track these versions on your own servers

InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.

Try the live demo Buy now

Weekly exploited-vulnerability digest

The KEV additions that matter for self-hosted servers, once a week. No other mail.

Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).