Skip to content
Noroxi

Jenkins records

1,837 published records for vendor Jenkins. 7 of them have been exploited in the wild (listed in CISA KEV) and 14 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
7 · 0.4%
Weaponized
14 · 0.8%
Pre-auth RCE
17
With a fix record
67.2%
Median publish → KEV
1144 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

1,837 records
  • CVE-2024-23897
    99Now

    Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character follo

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    jenkins · jenkinsJan 24, 2024

  • CVE-2017-1000353
    99Now

    Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    jenkins · jenkinsJan 29, 2018

  • CVE-2018-1000861
    98Now

    A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/cor

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    jenkins · jenkinsDec 10, 2018

  • CVE-2019-1003030
    98Now

    A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/wo

    CriticalCVSS 9.9KEVWeaponizedEPSS 97%

    jenkins · pipeline\Mar 8, 2019

  • CVE-2019-1003029
    91Now

    A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecuri

    CriticalCVSS 9.9KEVWeaponizedEPSS 74%

    jenkins · script securityMar 8, 2019

  • CVE-2023-44487
    90Now

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    siemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmwareOct 10, 2023

  • CVE-2016-9299
    68This week

    The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized

    CriticalCVSS 9.8WeaponizedEPSS 96%

    jenkins · jenkinsJan 12, 2017

  • CVE-2015-8103
    67This week

    The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted ser

    CriticalCVSS 9.8WeaponizedEPSS 91%

    jenkins · jenkinsNov 25, 2015

  • CVE-2015-5317
    67This week

    The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name in

    HighCVSS 7.5KEVWeaponizedEPSS 23%

    jenkins · jenkinsNov 25, 2015

  • CVE-2019-1003000
    65This week

    A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandb

    HighCVSS 8.8WeaponizedEPSS 98%

    jenkins · script securityJan 22, 2019

  • CVE-2018-1000600
    62This week

    A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java t

    HighCVSS 8.8Proof of conceptEPSS 90%

    jenkins · githubJun 26, 2018

  • CVE-2019-1003001
    61This week

    A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlo

    HighCVSS 8.8WeaponizedEPSS 86%

    jenkins · pipeline\Jan 22, 2019

  • CVE-2016-0792
    60This week

    Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code

    HighCVSS 8.8WeaponizedEPSS 83%

    jenkins · jenkinsApr 7, 2016

  • CVE-2019-1003002
    59Plan

    A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jen

    HighCVSS 8.8WeaponizedEPSS 81%

    jenkins · pipeline\Jan 22, 2019

  • CVE-2018-1999002
    56Plan

    A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stap

    HighCVSS 7.5Proof of conceptEPSS 86%

    jenkins · jenkinsJul 23, 2018

  • CVE-2024-54003
    56Plan

    Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability

    HighCVSS 8.0No exploitEPSS 81%

    jenkins · simple queueNov 27, 2024

  • CVE-2024-23898
    55Plan

    Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests ma

    HighCVSS 8.8Proof of conceptEPSS 67%

    jenkins · jenkinsJan 24, 2024

  • CVE-2024-34144
    54Plan

    A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows

    CriticalCVSS 9.8Proof of conceptEPSS 48%

    jenkins · script securityMay 2, 2024

  • CVE-2023-32986
    53Plan

    Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File

    HighCVSS 8.8No exploitEPSS 60%

    jenkins · file parametersMay 16, 2023

  • CVE-2020-2096
    52Plan

    Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerabi

    MediumCVSS 6.1Proof of conceptEPSS 93%

    jenkins · gitlab hookJan 15, 2020

  • CVE-2021-21659
    52Plan

    Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    HighCVSS 8.1No exploitEPSS 66%

    jenkins · urltriggerMay 25, 2021

  • CVE-2026-53435
    50Plan

    In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in J

    HighCVSS 8.8Proof of conceptEPSS 51%

    jenkins · jenkinsJun 10, 2026

  • CVE-2021-21699
    48Plan

    Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters,

    MediumCVSS 5.4No exploitEPSS 88%

    jenkins · active choicesNov 12, 2021

  • CVE-2020-2140
    47Plan

    Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a refl

    MediumCVSS 6.1Proof of conceptEPSS 75%

    jenkins · audit trailMar 9, 2020

  • CVE-2021-21669
    47Plan

    Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    CriticalCVSS 9.8No exploitEPSS 25%

    jenkins · generic webhook triggerJun 18, 2021