Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Advisory: Jenkins — Jenkins Security Advisory 2026-08-05 Clear all filters
TI-2026-49205 CVE-2026-70430 · GHSA-xv7v-hw45-9jgw

Improper access control in Jenkins

Priority LOW 14

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission t…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00476 Published 2026-08-05 Partial fix · 2.576, 2.568.2 CWE-284
TI-2026-49204 CVE-2026-70429 · GHSA-7fgq-gph8-29q5

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user…

Priority LOW 38

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match o…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00419 Published 2026-08-05 Partial fix · 2.576, 2.568.2 CWE-178
TI-2026-49203 CVE-2026-70428 · GHSA-c232-r242-w9v9

Path traversal in Jenkins

Priority LOW 21

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to ar…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00664 Published 2026-08-05 Partial fix · 2.576, 2.568.2 CWE-22
TI-2026-49202 CVE-2026-70427 · GHSA-xvrr-fjq7-cfrw

Link following in Jenkins

Priority LOW 21

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able to control agent proce…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00664 Published 2026-08-05 Partial fix · 2.576, 2.568.2 CWE-59
TI-2026-49201 CVE-2026-70426 · GHSA-v269-8r2r-vj93

Deserialization of untrusted data in Jenkins

Priority MEDIUM 41

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path…

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.00515 Published 2026-08-05 Partial fix · 2.576, 2.568.2 +2 CWE-502