Read the docs

Jenkins

Records1915All Threatist records
Exploited (KEV)7In CISA KEV
CVSS critical79CVSS 9.0–10.0
CVSS high524CVSS 7.0–8.9

Exploited now

Jenkins records in CISA KEV
TI-2017-14573 Jenkins Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2025-10-02TI-2024-15885 Jenkins Command Line Interface (CLI) Path Traversal Vulnerability Priority CRITICAL 100KEV 2024-08-19TI-2023-23979 HTTP/2 Rapid Reset Attack Vulnerability Priority CRITICAL 90KEV 2023-10-10TI-2015-04472 Jenkins User Interface (UI) Information Disclosure Vulnerability Priority CRITICAL 90KEV 2023-05-12TI-2019-15874 Jenkins Script Security Plugin Sandbox Bypass Vulnerability Priority CRITICAL 100KEV 2022-04-25TI-2019-15875 Jenkins Matrix Project Plugin Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Jenkins 294 records CRITICAL Script Security 45 records CRITICAL Pipeline 40 records CRITICAL Active Directory 12 records MEDIUM Blue Ocean 11 records MEDIUM Email Extension 11 records MEDIUM Git 11 records MEDIUM Build Failure Analyzer 9 records MEDIUM

Records

8 records in Github Branch Source · all components

TI-2024-15889 CVE-2024-23901 · GHSA-fw9h-cxx9-gfq3

Information disclosure in Jenkins GitLab Branch Source Plugin

Priority LOW 35

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00458 Published 2024-01-24 Fixed in 688.v5fa CWE-200
TI-2024-15891 CVE-2024-23903 · GHSA-f67f-2j6r-m4c9

Incorrect comparison in Jenkins GitLab Branch Source Plugin

Priority LOW 31

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.005 Published 2024-01-24 Fixed in 688.v5fa CWE-697
TI-2018-15834 CVE-2018-1000185 · GHSA-9cfq-v2hm-c3xr

A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin…

Priority LOW 21

A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specif…

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00642 Published 2018-06-05 Fixed in 2.3.5 CWE-918
TI-2026-41222 CVE-2026-57285 · GHSA-g7c6-wxjf-8564

Missing authorization in Jenkins GitHub Branch Source Plugin

Priority LOW 20

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00281 Published 2026-06-24 Partial fix · 1967.1970 CWE-862
TI-2024-15890 CVE-2024-23902 · GHSA-8r93-59cf-358f

Cross-site request forgery in Jenkins GitLab Branch Source Plugin

Priority LOW 20

A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an attacker-specified URL.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00323 Published 2024-01-24 Fixed in 688.v5fa CWE-352
TI-2026-30805 CVE-2026-42522 · GHSA-wg26-8wmj-cf9p

Missing authorization in Jenkins GitHub Branch Source Plugin

Priority LOW 19

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub Ap…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00184 Published 2026-04-29 Fixed in 1967.1969.v205fd594c821 CWE-862
Open these records in search →