Jenkins project vulnerabilities

CVEs per yearBy the year they were published

1. 20183
2. 2019338
3. 2020235
4. 20201
5. 2021103
6. 2022391
7. 2023243
8. 202449
9. 202597
10. 2026153

Known exploitedNewest addition to KEV first

• CVE-2024-23897

  Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path…

  Jenkins Project · Jenkins

  ExploitedCritical9.8
• CVE-2019-1003029

  A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/Gr…

  Jenkins project · Jenkins Script Security Plugin

  ExploitedCritical9.9
• CVE-2019-1003030

  A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml,…

  Jenkins project · Jenkins Pipeline: Groovy Plugin

  ExploitedCritical9.9

Newest CVEs

• CVE-2026-117626

  Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and…

  Jenkins Project · Jenkins

  Not scored
• CVE-2026-117625

  A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user…

  Jenkins Project · Jenkins

  Not scored
• CVE-2026-117624

  Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their…

  Jenkins Project · Jenkins

  High8.8
• CVE-2026-117623

  Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a…

  Jenkins Project · Jenkins

  Medium5.4
• CVE-2026-117622

  Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller,…

  Jenkins Project · Jenkins

  Medium6.1
• CVE-2026-117621

  Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory,…

  Jenkins Project · Jenkins

  Medium6.1
• CVE-2026-117620

  Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can…

  Jenkins Project · Jenkins

  High8.8
• CVE-2026-117619

  Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a…

  Jenkins Project · Jenkins

  High8.1
• CVE-2026-117618

  In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been…

  Jenkins Project · Jenkins

  High8.1
• CVE-2026-117617

  Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not…

  Jenkins Project · Jenkins

  High8.1