Jenkins Security Vulnerabilities (CVEs)
Track 196 security vulnerabilities affecting Jenkins products and software. Get instant email alerts when new CVEs are discovered, automated security monitoring, and patch guidance.
The Jenkins SSH2 Easy Plugin vulnerability allows users who previously had optional permissions (like Overall/Manage) to retain access to functionalit...
Sep 6, 2023This CVE describes a missing authorization vulnerability in the Jenkins ServiceNow DevOps plugin versions before 1.38.1. Attackers could exploit this ...
Jul 26, 2023This CSRF vulnerability in Jenkins ElasticBox CI Plugin allows attackers to trick authenticated users into unknowingly connecting Jenkins to attacker-...
Jul 12, 2023The Jenkins OpenShift Login Plugin vulnerability allows session fixation attacks where previous sessions aren't invalidated upon new login. This enabl...
Jul 12, 2023This vulnerability in Jenkins Orka by MacStadium Plugin allows attackers with Overall/Read permission to connect to attacker-controlled URLs using sto...
Jul 12, 2023A CSRF vulnerability in Jenkins Pipeline restFul API Plugin 0.11 and earlier allows attackers to trick authenticated users into unknowingly connecting...
Jul 12, 2023A CSRF vulnerability in Jenkins Assembla Auth Plugin 1.14 and earlier allows attackers to trick authenticated users into unknowingly logging into the ...
Jul 12, 2023This is a Cross-Site Request Forgery (CSRF) vulnerability in Jenkins where insufficient URL escaping allows attackers to trick authenticated users int...
Jun 14, 2023The Jenkins CAS Plugin 1.6.2 and earlier fails to invalidate previous user sessions upon login, allowing session fixation attacks. This vulnerability ...
May 16, 2023The Jenkins NS-ND Integration Performance Publisher Plugin versions 4.8.0.149 and earlier expose credentials in plain text on configuration forms inst...
May 16, 2023This CSRF vulnerability in Jenkins SAML SSO Plugin allows attackers to trick authenticated users into making unintended HTTP requests to attacker-cont...
May 16, 2023This CSRF vulnerability in Jenkins SAML SSO Plugin allows attackers to trick authenticated users into unknowingly sending malicious HTTP POST requests...
May 16, 2023The Jenkins File Parameter Plugin vulnerability allows attackers with Item/Configure permission to write arbitrary files with attacker-controlled cont...
May 16, 2023This CSRF vulnerability in Jenkins Azure VM Agents Plugin allows attackers to trick authenticated users into connecting Jenkins to attacker-controlled...
May 16, 2023This vulnerability in Jenkins Pipeline Utility Steps Plugin allows attackers who can provide crafted archive files as parameters to write arbitrary fi...
May 16, 2023This CSRF vulnerability in Jenkins OctoPerf Load Testing Plugin allows attackers to trick authenticated users into connecting to attacker-controlled O...
Apr 2, 2023This CSRF vulnerability in Jenkins Convert To Pipeline Plugin allows attackers to trick authenticated users into unknowingly creating pipelines from f...
Apr 2, 2023This vulnerability in Jenkins Convert To Pipeline Plugin allows attackers with permission to configure Freestyle projects to inject malicious Pipeline...
Apr 2, 2023The Jenkins Crap4J Plugin 0.9 and earlier contains an XML external entity (XXE) vulnerability due to improper XML parser configuration. This allows at...
Apr 2, 2023The Jenkins Performance Publisher Plugin 8.09 and earlier contains an XML external entity (XXE) vulnerability due to improper XML parser configuration...
Apr 2, 2023The Jenkins Role-based Authorization Strategy Plugin vulnerability allows users to retain permissions even after they've been disabled in the system c...
Apr 2, 2023This stored cross-site scripting (XSS) vulnerability in Jenkins allows attackers to inject malicious scripts into error messages about plugin incompat...
Mar 10, 2023This vulnerability in Jenkins allows attackers to cause denial of service by exploiting improper request handling in the Apache Commons FileUpload lib...
Mar 10, 2023This stored XSS vulnerability in Jenkins update-center2 allows attackers who can provide plugins for hosting to inject malicious scripts into plugin d...
Mar 10, 2023This vulnerability in Jenkins Email Extension Plugin allows attackers with folder-level email template creation permissions to bypass script security ...
Feb 15, 2023A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin allows attackers to trick authenticated users into connecting Je...
Feb 15, 2023This CSRF vulnerability in Jenkins Coverity Plugin allows attackers to trick authenticated users into connecting Jenkins to attacker-controlled URLs u...
Jul 27, 2022A CSRF vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to trick authenticated users into performing unauthorized ...
Jul 27, 2022This vulnerability in Jenkins Deployer Framework Plugin allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins con...
Jul 27, 2022The Jenkins Compuware ISPW Operations Plugin vulnerability allows attackers who control Jenkins agent processes to retrieve Java system properties fro...
Jul 27, 2022This CSRF vulnerability in Jenkins Git Plugin allows attackers to trigger unauthorized builds of jobs configured with Git repositories. Attackers can ...
Jul 27, 2022This vulnerability in Eclipse Jetty's HTTP/2 server implementation allows attackers to cause denial of service by sending invalid HTTP/2 requests that...
Jul 7, 2022This CSRF vulnerability in Jenkins Recipe Plugin allows attackers to trick authenticated users into making unintended HTTP requests to attacker-contro...
Jun 30, 2022This CSRF vulnerability in Jenkins Convertigo Mobile Platform Plugin allows attackers to trick authenticated users into making unintended requests to ...
Jun 23, 2022This CSRF vulnerability in Jenkins EasyQA Plugin allows attackers to trick authenticated users into making unintended requests to attacker-controlled ...
Jun 23, 2022This vulnerability in Jenkins creates a timing side-channel in the login form that allows attackers to distinguish between invalid usernames and valid...
Jun 23, 2022This vulnerability in Jenkins Pipeline: Input Step Plugin allows attackers with Pipeline configuration permissions to write arbitrary files on the Jen...
Jun 23, 2022The Jenkins Embeddable Build Status Plugin before version 2.0.4 has a path traversal vulnerability that allows attackers without proper permissions to...
Jun 23, 2022The Jenkins xUnit Plugin vulnerability allows attackers with control over agent processes to create arbitrary directories on the Jenkins controller or...
Jun 23, 2022A CSRF vulnerability in Jenkins Autocomplete Parameter Plugin allows attackers to trick authenticated administrators into executing arbitrary code wit...
May 17, 2022CVE-2022-30971 is an XML external entity (XXE) vulnerability in the Jenkins Storable Configs Plugin, allowing attackers to read arbitrary files from t...
May 17, 2022This CSRF vulnerability in Jenkins SSH Plugin allows attackers to trick authenticated users into unknowingly connecting to attacker-controlled SSH ser...
May 17, 2022CVE-2022-30950 is a buffer overflow vulnerability in Jenkins WMI Windows Agents Plugin 1.8 and earlier that allows authenticated users who can connect...
May 17, 2022This vulnerability in Jenkins Pipeline: Groovy Plugin allows attackers in sandboxed pipelines to load arbitrary Groovy source files from the Jenkins c...
May 17, 2022The Jenkins Git Plugin vulnerability allows attackers with pipeline configuration permissions to access limited information from other projects' SCM r...
May 17, 2022This CSRF vulnerability in Jenkins Publish Over FTP Plugin allows attackers to trick authenticated users into connecting to attacker-controlled FTP se...
Apr 12, 2022This vulnerability in Jenkins Coverage/Complexity Scatter Plot Plugin allows attackers to perform XML External Entity (XXE) attacks by exploiting impr...
Mar 29, 2022This CSRF vulnerability in Jenkins Job and Node ownership Plugin allows attackers to change job owners and permissions without authentication. It affe...
Mar 29, 2022This CSRF vulnerability in Jenkins JiraTestResultReporter Plugin allows attackers to trick authenticated users into connecting Jenkins to attacker-con...
Mar 29, 2022The Jenkins Flaky Test Handler Plugin 1.2.1 and earlier contains an XML external entity (XXE) vulnerability due to improper XML parser configuration. ...
Mar 29, 2022Why Monitor Jenkins Security Vulnerabilities?
Real-time CVE tracking: Our automated system monitors 196+ known vulnerabilities affecting Jenkins products and software packages. Stay ahead of emerging threats with instant email notifications when new security issues are discovered.
Automated security monitoring: Unlike manual CVE checking, FixTheCVE automatically scans your servers and detects vulnerable Jenkins packages in under 60 seconds. No agents required - completely agentless scanning that works across Jenkins deployments.
Free vulnerability database: Access detailed information about every Jenkins CVE including CVSS scores, severity ratings, affected versions, and actionable patch guidance. Filter by critical, high, medium, or low severity to prioritize your security remediation efforts.
🚀 Get Started in 60 Seconds
- Register free account & add your servers
- Run one-time scan or schedule automatic monitoring (every 1-24 hours)
- Receive instant alerts when new Jenkins CVEs affect your systems
- Access dashboard with severity breakdown & fix instructions
