Jenkins Project

Products

Product	CVEs	Exploited	Latest
Jenkins	136	1	Oct 28, 2026
Jenkins Script Security Plugin	28	1	Sep 16, 2026
Jenkins Pipeline: Groovy Plugin	10	1	Jun 24, 2026
Jenkins Active Directory Plugin	10	–	Jun 24, 2026
Jenkins Job Configuration History Plugin	8	–	Sep 2, 2026
Jenkins NS-ND Integration Performance Publisher Plugin	8	–	May 16, 2023
Jenkins Email Extension Plugin	8	–	May 27, 2026
Jenkins Git Plugin	7	–	Aug 23, 2022
Jenkins OpenId Connect Authentication Plugin	7	–	Jan 22, 2025
Jenkins Pipeline: Shared Groovy Libraries Plugin	7	–	Apr 12, 2022
Jenkins SAML Single Sign On(SSO) Plugin	7	–	Jul 12, 2023
Jenkins HashiCorp Vault Plugin	6	–	Dec 10, 2025
Jenkins Deployment Dashboard Plugin	6	–	Dec 13, 2023
Jenkins GitLab Plugin	6	–	Sep 16, 2026
Jenkins Credentials Binding Plugin	6	–	May 27, 2026
Jenkins Git Parameter Plugin	6	–	Jun 24, 2026
Jenkins Amazon EC2 Plugin	6	–	May 6, 2020
Jenkins Scriptler Plugin	5	–	Dec 13, 2023
Jenkins Pipeline Maven Integration Plugin	5	–	Sep 6, 2023
Jenkins AppSpider Plugin	5	–	May 27, 2026
Jenkins Subversion Plugin	5	–	Apr 12, 2022
Jenkins AWS CodeCommit Trigger Plugin	5	–	Sep 6, 2023
Jenkins Config File Provider Plugin	5	–	Aug 16, 2023
Jenkins OctoPerf Load Testing Plugin Plugin	5	–	Mar 23, 2023
Jenkins Build Failure Analyzer Plugin	5	–	Sep 20, 2023
Jenkins Extended Choice Parameter Plugin	5	–	Apr 12, 2022
Jenkins XebiaLabs XL Deploy Plugin	5	–	Sep 2, 2026
Jenkins Publish Over SSH Plugin	5	–	Jan 12, 2022
Jenkins HTML Publisher Plugin	5	–	Apr 29, 2026
Jenkins OpenShift Deployer Plugin	5	–	Jul 27, 2022
Jenkins WSO2 Oauth Plugin	5	–	May 14, 2025
Jenkins Repository Connector Plugin	5	–	Jul 27, 2022
Jenkins Fortify Plugin	5	–	Aug 21, 2023
Jenkins Blue Ocean Plugin	5	–	Aug 16, 2023
Jenkins LDAP Plugin	4	–	Sep 2, 2026
Jenkins mabl Plugin	4	–	Jul 12, 2023
Jenkins Pipeline: Groovy Libraries Plugin	4	–	Sep 16, 2026
Jenkins Pipeline: Phoenix AutoTest Plugin	4	–	Mar 29, 2022
Jenkins Cadence vManager Plugin	4	–	May 14, 2025
Jenkins Mercurial Plugin	4	–	Oct 19, 2022
Jenkins Proxmox Plugin	4	–	Mar 29, 2022
Jenkins Deployer Framework Plugin	4	–	Jul 27, 2022
Jenkins Pipeline: Build Step Plugin	4	–	Sep 2, 2026
Jenkins Rundeck Plugin	4	–	Sep 21, 2022
Jenkins Continuous Integration with Toad Edge Plugin	4	–	Mar 29, 2022
Jenkins Kubernetes Plugin	4	–	Apr 12, 2023
Jenkins P4 Plugin	4	–	May 11, 2021
Jenkins Katalon Plugin	4	–	Oct 19, 2022
Jenkins Convertigo Mobile Platform Plugin	4	–	Jun 22, 2022
Jenkins requests-plugin Plugin	4	–	Jun 30, 2022
Jenkins Team Foundation Server Plugin	4	–	Mar 30, 2021
Jenkins GitLab Authentication Plugin	4	–	Jul 26, 2023
Jenkins Matrix Project Plugin	4	–	Jan 24, 2024
Jenkins Kubernetes Continuous Deploy Plugin	4	–	Mar 15, 2022
Jenkins Health Advisor by CloudBees Plugin	4	–	May 14, 2025
Jenkins Subversion Partial Release Manager Plugin	4	–	May 2, 2024
Jenkins Bitbucket Server Integration Plugin	4	–	Sep 16, 2026
Jenkins Nexus Platform Plugin	4	–	Dec 13, 2023
Jenkins Gitee Plugin	4	–	Sep 16, 2026
Jenkins Report Portal Plugin	4	–	Apr 12, 2023
Jenkins Storable Configs Plugin	4	–	May 17, 2022
Jenkins Git client Plugin	4	–	Jun 24, 2026
Jenkins Orka by MacStadium Plugin	4	–	Jul 12, 2023
Jenkins JIRA Pipeline Steps Plugin	4	–	Jan 24, 2023
Jenkins CONS3RT Plugin	4	–	Sep 21, 2022
Jenkins NeuVector Vulnerability Scanner Plugin	4	–	Nov 29, 2023
Jenkins Compuware Topaz for Total Test Plugin	4	–	Oct 19, 2022
Jenkins Checkmarx Plugin	4	–	Jun 14, 2023
Jenkins Azure AD Plugin	4	–	Sep 6, 2023
Jenkins PaaSLane Estimate Plugin	4	–	Dec 13, 2023
Jenkins Active Choices Plugin	4	–	Nov 12, 2021
Jenkins Job and Node ownership Plugin	4	–	Mar 29, 2022
Jenkins Contrast Continuous Application Security Plugin	4	–	Jun 24, 2026
Jenkins Bitbucket Branch Source Plugin	4	–	Jun 26, 2024
Jenkins Delphix Plugin	4	–	Mar 6, 2024
Jenkins Code Coverage API Plugin	3	–	Aug 31, 2021
Jenkins MATLAB Plugin	3	–	Nov 29, 2023
Jenkins Credentials Plugin	3	–	Oct 2, 2024
Jenkins Support Core Plugin	3	–	Nov 15, 2022
Jenkins Chef Sinatra Plugin	3	–	Feb 15, 2022
Jenkins TestQuality Updater Plugin	3	–	Jan 24, 2023
Jenkins Role-based Authorization Strategy Plugin	3	–	Mar 23, 2023
Jenkins Folders Plugin	3	–	Aug 16, 2023
Jenkins Bitbucket OAuth Plugin	3	–	May 27, 2026
Jenkins JUnit Plugin	3	–	Feb 15, 2023
Jenkins XebiaLabs XL Release Plugin	3	–	Jun 30, 2022
Jenkins EasyQA Plugin	3	–	Jun 22, 2022
Jenkins Azure VM Agents Plugin	3	–	May 16, 2023
Jenkins Pipeline: Multibranch Plugin	3	–	Sep 16, 2026
Jenkins Multijob Plugin	3	–	Aug 5, 2026
Jenkins S3 publisher Plugin	3	–	May 11, 2021
Jenkins Pipeline GitHub Notify Step Plugin	3	–	Feb 12, 2020
Jenkins Audit Trail Plugin	3	–	Oct 8, 2020
Jenkins GitHub Pull Request Builder Plugin	3	–	Jan 24, 2023
Jenkins Mailer Plugin	3	–	Jan 12, 2022
Jenkins GitLab Branch Source Plugin	3	–	Jan 24, 2024
Jenkins Project Inheritance Plugin	3	–	Jun 30, 2022
Jenkins Publish to Bitbucket Plugin	3	–	Oct 29, 2025
Jenkins Generic Webhook Trigger Plugin	3	–	Oct 19, 2022
Jenkins SSH Plugin	3	–	May 17, 2022
Jenkins Fortify on Demand Plugin	3	–	Jul 2, 2020
Jenkins Warnings Plugin	3	–	Sep 16, 2026
Jenkins SAML Plugin	3	–	Sep 2, 2026
Jenkins GitHub Plugin	3	–	Apr 29, 2026
Jenkins Embeddable Build Status Plugin	3	–	Jun 22, 2022
Jenkins CloudBees CD Plugin	3	–	Oct 25, 2023
Jenkins RQM Plugin	3	–	Sep 21, 2022
Jenkins Semantic Versioning Plugin	3	–	Jan 24, 2023
Jenkins Mac Plugin	3	–	Mar 9, 2020
Jenkins XPath Configuration Viewer Plugin	3	–	Jun 30, 2022
Jenkins Parameterized Remote Trigger Plugin	3	–	Sep 2, 2026
Jenkins OpenID Plugin	3	–	Jan 24, 2023
Jenkins Flaky Test Handler Plugin	3	–	Aug 16, 2023
Jenkins Azure Credentials Plugin	3	–	Feb 15, 2023
Jenkins RocketChat Notifier Plugin	3	–	Jun 30, 2022
Jenkins promoted builds Plugin	3	–	Apr 12, 2022
Jenkins Build-Publisher Plugin	3	–	Sep 21, 2022
Jenkins Lucene-Search Plugin	3	–	Apr 12, 2023
Jenkins Matrix Authorization Strategy Plugin	3	–	Apr 29, 2026
Jenkins CVS Plugin	3	–	Apr 12, 2022
Jenkins Keycloak Authentication Plugin	3	–	Sep 16, 2026
Jenkins Assembla Plugin	3	–	Jun 24, 2026
Jenkins dbCharts Plugin	3	–	Mar 15, 2022
Jenkins FitNesse Plugin	3	–	Jun 24, 2026
Jenkins Zephyr for JIRA Test Management Plugin	3	–	Jul 2, 2020
Jenkins Recipe Plugin	3	–	Jun 30, 2022
Jenkins Coverity Plugin	3	–	Jul 27, 2022
Jenkins Conjur Secrets Plugin	3	–	Feb 15, 2022
Jenkins CloudBees AWS Credentials Plugin	3	–	Mar 15, 2022
Jenkins Bitbucket Push and Pull Request Plugin	3	–	Sep 16, 2026
Jenkins ElasTest Plugin	3	–	Sep 16, 2020
Jenkins Autocomplete Parameter Plugin	3	–	May 17, 2022
Jenkins Gogs Plugin	3	–	Oct 25, 2023
Jenkins Applitools Eyes Plugin	3	–	Jul 9, 2025
Jenkins Openstack Heat Plugin	3	–	Jul 27, 2022
Jenkins Ansible Plugin	3	–	May 16, 2023
Jenkins OWASP Dependency-Check Plugin	3	–	Sep 16, 2026
Jenkins Liquibase Runner Plugin	3	–	Sep 23, 2020
Jenkins Dynamic Extended Choice Parameter Plugin	3	–	Jul 27, 2022
Jenkins DotCi Plugin	3	–	Sep 21, 2022
Jenkins database Plugin	3	–	Sep 1, 2020
Jenkins TestComplete support Plugin	3	–	May 16, 2023
Jenkins AsakusaSatellite Plugin	2	–	Apr 2, 2025
Jenkins Dingding JSON Pusher Plugin	2	–	Dec 13, 2023
Jenkins build-metrics Plugin	2	–	Jun 30, 2022
Jenkins Pipeline Utility Steps Plugin	2	–	May 16, 2023
Jenkins Chaos Monkey Plugin	2	–	Dec 3, 2020
Jenkins Convert To Pipeline Plugin	2	–	Mar 23, 2023
Jenkins File Parameter Plugin	2	–	Sep 2, 2026
Jenkins ReadyAPI Functional Testing Plugin	2	–	Jul 9, 2025
Jenkins Gerrit Trigger Plugin	2	–	Jan 24, 2023
Jenkins VncRecorder Plugin	2	–	Jul 2, 2020
Jenkins Perfecto Plugin	2	–	Sep 16, 2020
Jenkins Release Helper Plugin	2	–	Mar 15, 2022
Jenkins Beaker builder Plugin	2	–	Jun 22, 2022
Jenkins Job Import Plugin	2	–	May 27, 2026
Jenkins vRealize Orchestrator Plugin	2	–	Jun 22, 2022
Jenkins TestNG Results Plugin	2	–	May 16, 2023
Jenkins Tests Selector Plugin	2	–	Mar 29, 2022
Jenkins OWASP Dependency-Track Plugin	2	–	Mar 30, 2021
Jenkins Matrix Reloaded Plugin	2	–	Jun 30, 2022
Jenkins BigPanda Notifier Plugin	2	–	Sep 21, 2022
Jenkins Image Tag Parameter Plugin	2	–	Apr 12, 2023
Jenkins MongoDB Plugin	2	–	Sep 16, 2020
Jenkins Templating Engine Plugin	2	–	Apr 2, 2025
Jenkins Azure Service Fabric Plugin	2	–	Jan 22, 2025
Jenkins Self-Organizing Swarm Plug-in Modules Plugin	2	–	Jun 3, 2020
Jenkins ECharts API Plugin	2	–	Jun 3, 2020
Jenkins Tag Profiler Plugin	2	–	May 16, 2023
Jenkins Compuware ISPW Operations Plugin	2	–	Jul 27, 2022
Jenkins SCM-Manager Plugin	2	–	Aug 5, 2026
Jenkins Compuware Xpediter Code Coverage Plugin	2	–	Oct 19, 2022
Jenkins SCM HttpClient Plugin	2	–	Sep 21, 2022
Jenkins global-build-stats Plugin	2	–	Sep 3, 2025
Jenkins Sensedia Api Platform tools Plugin	2	–	Jul 9, 2025
Jenkins Performance Plugin	2	–	Sep 2, 2026
Jenkins Sumologic Publisher Plugin	2	–	Jul 12, 2023
Jenkins Microsoft Entra ID (previously Azure AD) Plugin	2	–	Sep 2, 2026
Jenkins Cobertura Plugin	2	–	Mar 9, 2020
Jenkins Agent Server Parameter Plugin	2	–	Jun 22, 2022
Jenkins WMI Windows Agents Plugin	2	–	May 17, 2022
Jenkins JiraTestResultReporter Plugin	2	–	Mar 29, 2022
Jenkins OpsGenie Plugin	2	–	Jun 30, 2022
Jenkins MCP Server Plugin	2	–	Jun 24, 2026
Jenkins NUnit Plugin	2	–	Oct 19, 2022
Jenkins External Workspace Manager Plugin	2	–	Aug 5, 2026
Jenkins Xray - Test Management for Jira Plugin	2	–	May 11, 2021
Jenkins Maven Cascade Release Plugin	2	–	Oct 8, 2020
Jenkins Build With Parameters Plugin	2	–	Mar 30, 2021
Jenkins Build Notifications Plugin	2	–	Jun 30, 2022
Jenkins Sauce OnDemand Plugin	2	–	Aug 5, 2026
Jenkins BearyChat Plugin	2	–	Jan 24, 2023
Jenkins Google Cloud Backup Plugin	2	–	Jul 27, 2022
Jenkins Cluster Statistics Plugin	2	–	Nov 15, 2022
Jenkins Failed Job Deactivator Plugin	2	–	Jun 30, 2022
Jenkins Pipeline: Input Step Plugin	2	–	Oct 19, 2022
Jenkins Nouvola DiveCloud Plugin	2	–	Jul 9, 2025
Jenkins Request Rename Or Delete Plugin	2	–	Jun 30, 2022
Jenkins Maven Repository Server Plugin	2	–	Jun 14, 2023
Jenkins Coverage Plugin	2	–	Sep 16, 2026

Exploited and recent CVEs

CVE-2024-23897 Critical 9.8 Exploited Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, 100.0%
CVE-2019-1003030 Critical 9.9 Exploited A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to 97.1%
CVE-2019-1003029 Critical 9.9 Exploited A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenk 74.4%
CVE-2026-117626 Medium 4.3 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with 0.3%
CVE-2026-117625 Medium 4.3 A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the conf 0.2%
CVE-2026-117624 High 8.8 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level config 0.4%
CVE-2026-117623 Medium 5.4 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerabilit 0.3%
CVE-2026-117622 Medium 6.1 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnera 0.3%
CVE-2026-117621 Medium 6.1 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulne 0.3%
CVE-2026-117620 High 8.8 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject a 0.4%
CVE-2026-117619 High 8.1 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who 0.3%
CVE-2026-117618 High 8.1 In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition t 0.3%
CVE-2026-117617 High 8.1 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows 0.5%
CVE-2026-117616 High 8.8 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.x 0.6%
CVE-2026-117615 Medium 6.5 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read 0.4%
CVE-2026-117614 High 8.8 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they 0.4%
CVE-2026-117613 Medium 5.4 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted 0.3%
CVE-2026-117612 High 8.8 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization. 0.4%
CVE-2026-92141 Medium 4.3 Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks. 0.3%
CVE-2026-92140 Medium 6.8 Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exp 0.4%
CVE-2026-92139 Medium 6.5 Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those UR 0.2%
CVE-2026-92138 Medium 4.2 The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather than from the server-side stored request 0.1%
CVE-2026-92137 High 8.8 Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller 0.8%
CVE-2026-92136 High 8.0 Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability explo 0.4%
CVE-2026-92135 High 8.0 Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure pe 0.4%
CVE-2026-92134 High 8.0 Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configu 0.4%
CVE-2026-92133 Medium 5.4 Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omittin 0.2%
CVE-2026-92132 Medium 5.4 Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global c 0.3%
CVE-2026-92131 Medium 4.2 Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follow 0.2%
CVE-2026-92130 Low 3.1 Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure 0.2%