CVE-2026-57288Low 3.7Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attac0.3%
CVE-2026-48919Medium 6.6Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.0.3%
CVE-2026-48918Medium 6.6Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.0.2%
CVE-2023-37943UnratedJenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing attackers able to ca0.5%
CVE-2022-23105UnratedJenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations.0.5%
CVE-2020-2303UnratedA cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting to attacker-specified or previously confi0.7%
CVE-2020-2301UnratedJenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windo1.7%
CVE-2020-2302UnratedA missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check diagnostic page.0.7%
CVE-2020-2300UnratedJenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenkins as any user depending on the configura1.7%
CVE-2020-2299UnratedJenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password.1.3%