CVE Tools
Track your stack

Jenkins

303 CVEs tracked. 5 of them are in CISA KEV.

This hub aggregates every CVE we track for Jenkins, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.

Jenkins CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Jenkins CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-034
2025-042
2025-050
2025-060
2025-071
2025-080
2025-093
2025-100
2025-110
2025-125
2026-010
2026-022
2026-032
2026-040
2026-050
2026-068
2026-070
2026-085
2026-0913
2026-1015
2026-110

Severity

How the 303 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical207%
  • High7826%
  • Medium19163%
  • Low145%

Latest CVEs

The 15 most recently published vulnerabilities affecting Jenkins.

  1. CVE-2026-117626Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers w...4.3
  2. CVE-2026-117624Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level con...8.8
  3. CVE-2026-117625A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the c...4.3
  4. CVE-2026-117623Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerabi...5.4
  5. CVE-2026-117621Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vu...6.1
  6. CVE-2026-117622Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vuln...6.1
  7. CVE-2026-117620Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to injec...8.8
  8. CVE-2026-117619Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers w...8.1
  9. CVE-2026-117618In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race conditio...8.1
  10. CVE-2026-117617Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and all...8.1
  11. CVE-2026-117616Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any confi...8.8
  12. CVE-2026-117614Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether t...8.8
  13. CVE-2026-117615Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to r...6.5
  14. CVE-2026-117613Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit craft...5.4
  15. CVE-2026-117612Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.8.8

Product grouping is registry-driven, with AI assist and human review. How it works