CVE Tools
Track your stack

Jenkins

1,636 CVEs tracked since 2011. Since Dec 2019, 2 of them reached CISA KEV.

Jenkins CVEs per month

Dec 2019 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Jenkins CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2019-12280
2020-01210
2020-02260
2020-03380
2020-04no snapshot
2020-05no snapshot
2020-06110
2020-07no snapshot
2020-0890
2020-09480
2020-10130
2020-11210
2020-1250
2021-01140
2021-0270
2021-03no snapshot
2021-04100
2021-05130
2021-06160
2021-072 or fewer
2021-0850
2021-092 or fewer
2021-1030
2021-11200
2021-122 or fewer
2022-01240
2022-02420
2022-03520
2022-04170
2022-05280
2022-06860
2022-07440
2022-0830
2022-09320
2022-10350
2022-11240
2022-1270
2023-01380
2023-02110
2023-03no snapshot
2023-04200
2023-05360
2023-06100
2023-07320
2023-08190
2023-09270
2023-10131
2023-1170
2023-12160
2024-0191
2024-024 or fewer
2024-03160
2024-044 or fewer
2024-0560
2024-064 or fewer
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-1050
2024-1180
2024-123 or fewer
2025-0170
2025-023 or fewer
2025-0360
2025-04110
2025-0560
2025-064 or fewer
2025-07320
2025-084 or fewer
2025-0960
2025-10200
2025-114 or fewer
2025-1290
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-0470
2026-05130
2026-06360
2026-077 or fewer
2026-08230
2026-09530
2026-10150
2026-110

Products

The products that kept showing up in Jenkins's monthly top three, with their CVEs summed over those months.

  1. Jenkins11319 months
  2. Pipeline\183 months
  3. Jenkins Script Security Plugin122 months
  4. Script Security122 months
  5. Active Directory72 months
  6. Jenkins Active Directory Plugin72 months
  7. Jenkins Pipeline: Shared Groovy Libraries Plugin61 month
  8. Jenkins Saml Single Sign On(Sso) Plugin61 month
  9. Code Dx51 month
  10. Deployment Dashboard51 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Jenkins.

  1. CVE-2026-117624Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level con...8.8
  2. CVE-2026-117623Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerabi...5.4
  3. CVE-2026-117621Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vu...6.1
  4. CVE-2026-117622Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vuln...6.1
  5. CVE-2026-117620Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to injec...8.8
  6. CVE-2026-117619Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers w...8.1
  7. CVE-2026-117618In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race conditio...8.1
  8. CVE-2026-117617Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and all...8.1
  9. CVE-2026-117616Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any confi...8.8
  10. CVE-2026-117614Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether t...8.8
  11. CVE-2026-117615Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to r...6.5
  12. CVE-2026-117613Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit craft...5.4
  13. CVE-2026-117612Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.8.8
  14. CVE-2026-92129Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission t...7.5
  15. CVE-2026-92127Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item...8.0

The record

Peak rank
#5 in Jun 2022
Busiest month shown
Jun 2022, 86 CVEs
Months with a KEV entry
2 since Dec 2019
Monthly snapshots
90 since 2011
Jenkins's full record, month by month