Jenkins Project

Products

Product	CVEs	Exploited	Latest
Jenkins	136	1	Oct 28, 2026
Jenkins Script Security Plugin	28	1	Sep 16, 2026
Jenkins Pipeline: Groovy Plugin	10	1	Jun 24, 2026
Jenkins Active Directory Plugin	10	–	Jun 24, 2026
Jenkins Job Configuration History Plugin	8	–	Sep 2, 2026
Jenkins NS-ND Integration Performance Publisher Plugin	8	–	May 16, 2023
Jenkins Email Extension Plugin	8	–	May 27, 2026
Jenkins Pipeline: Shared Groovy Libraries Plugin	7	–	Apr 12, 2022
Jenkins Git Plugin	7	–	Aug 23, 2022
Jenkins SAML Single Sign On(SSO) Plugin	7	–	Jul 12, 2023
Jenkins OpenId Connect Authentication Plugin	7	–	Jan 22, 2025
Jenkins Credentials Binding Plugin	6	–	May 27, 2026
Jenkins Deployment Dashboard Plugin	6	–	Dec 13, 2023
Jenkins Git Parameter Plugin	6	–	Jun 24, 2026
Jenkins Amazon EC2 Plugin	6	–	May 6, 2020
Jenkins HashiCorp Vault Plugin	6	–	Dec 10, 2025
Jenkins GitLab Plugin	6	–	Sep 16, 2026
Jenkins Build Failure Analyzer Plugin	5	–	Sep 20, 2023
Jenkins Config File Provider Plugin	5	–	Aug 16, 2023
Jenkins OctoPerf Load Testing Plugin Plugin	5	–	Mar 23, 2023
Jenkins OpenShift Deployer Plugin	5	–	Jul 27, 2022
Jenkins XebiaLabs XL Deploy Plugin	5	–	Sep 2, 2026
Jenkins Fortify Plugin	5	–	Aug 21, 2023
Jenkins AppSpider Plugin	5	–	May 27, 2026
Jenkins Blue Ocean Plugin	5	–	Aug 16, 2023
Jenkins Subversion Plugin	5	–	Apr 12, 2022
Jenkins WSO2 Oauth Plugin	5	–	May 14, 2025
Jenkins Extended Choice Parameter Plugin	5	–	Apr 12, 2022
Jenkins HTML Publisher Plugin	5	–	Apr 29, 2026
Jenkins AWS CodeCommit Trigger Plugin	5	–	Sep 6, 2023
Jenkins Publish Over SSH Plugin	5	–	Jan 12, 2022
Jenkins Pipeline Maven Integration Plugin	5	–	Sep 6, 2023
Jenkins Repository Connector Plugin	5	–	Jul 27, 2022
Jenkins Scriptler Plugin	5	–	Dec 13, 2023
Jenkins Kubernetes Plugin	4	–	Apr 12, 2023
Jenkins Pipeline: Phoenix AutoTest Plugin	4	–	Mar 29, 2022
Jenkins Pipeline: Groovy Libraries Plugin	4	–	Sep 16, 2026
Jenkins Pipeline: Build Step Plugin	4	–	Sep 2, 2026
Jenkins Bitbucket Server Integration Plugin	4	–	Sep 16, 2026
Jenkins Orka by MacStadium Plugin	4	–	Jul 12, 2023
Jenkins Team Foundation Server Plugin	4	–	Mar 30, 2021
Jenkins mabl Plugin	4	–	Jul 12, 2023
Jenkins Compuware Topaz for Total Test Plugin	4	–	Oct 19, 2022
Jenkins Matrix Project Plugin	4	–	Jan 24, 2024
Jenkins Job and Node ownership Plugin	4	–	Mar 29, 2022
Jenkins Azure AD Plugin	4	–	Sep 6, 2023
Jenkins Kubernetes Continuous Deploy Plugin	4	–	Mar 15, 2022
Jenkins Nexus Platform Plugin	4	–	Dec 13, 2023
Jenkins Mercurial Plugin	4	–	Oct 19, 2022
Jenkins NeuVector Vulnerability Scanner Plugin	4	–	Nov 29, 2023
Jenkins P4 Plugin	4	–	May 11, 2021
Jenkins CONS3RT Plugin	4	–	Sep 21, 2022
Jenkins Contrast Continuous Application Security Plugin	4	–	Jun 24, 2026
Jenkins PaaSLane Estimate Plugin	4	–	Dec 13, 2023
Jenkins LDAP Plugin	4	–	Sep 2, 2026
Jenkins Git client Plugin	4	–	Jun 24, 2026
Jenkins Convertigo Mobile Platform Plugin	4	–	Jun 22, 2022
Jenkins Continuous Integration with Toad Edge Plugin	4	–	Mar 29, 2022
Jenkins Bitbucket Branch Source Plugin	4	–	Jun 26, 2024
Jenkins Health Advisor by CloudBees Plugin	4	–	May 14, 2025
Jenkins Subversion Partial Release Manager Plugin	4	–	May 2, 2024
Jenkins JIRA Pipeline Steps Plugin	4	–	Jan 24, 2023
Jenkins Checkmarx Plugin	4	–	Jun 14, 2023
Jenkins Katalon Plugin	4	–	Oct 19, 2022
Jenkins Storable Configs Plugin	4	–	May 17, 2022
Jenkins Proxmox Plugin	4	–	Mar 29, 2022
Jenkins Gitee Plugin	4	–	Sep 16, 2026
Jenkins GitLab Authentication Plugin	4	–	Jul 26, 2023
Jenkins Report Portal Plugin	4	–	Apr 12, 2023
Jenkins Rundeck Plugin	4	–	Sep 21, 2022
Jenkins Active Choices Plugin	4	–	Nov 12, 2021
Jenkins requests-plugin Plugin	4	–	Jun 30, 2022
Jenkins Delphix Plugin	4	–	Mar 6, 2024
Jenkins Deployer Framework Plugin	4	–	Jul 27, 2022
Jenkins Cadence vManager Plugin	4	–	May 14, 2025
Jenkins Project Inheritance Plugin	3	–	Jun 30, 2022
Jenkins promoted builds Plugin	3	–	Apr 12, 2022
Jenkins Credentials Plugin	3	–	Oct 2, 2024
Jenkins Autocomplete Parameter Plugin	3	–	May 17, 2022
Jenkins Coverity Plugin	3	–	Jul 27, 2022
Jenkins Dynamic Extended Choice Parameter Plugin	3	–	Jul 27, 2022
Jenkins DotCi Plugin	3	–	Sep 21, 2022
Jenkins Pipeline GitHub Notify Step Plugin	3	–	Feb 12, 2020
Jenkins Audit Trail Plugin	3	–	Oct 8, 2020
Jenkins Pipeline: Multibranch Plugin	3	–	Sep 16, 2026
Jenkins Bitbucket Push and Pull Request Plugin	3	–	Sep 16, 2026
Jenkins Bitbucket OAuth Plugin	3	–	May 27, 2026
Jenkins Ansible Plugin	3	–	May 16, 2023
Jenkins Conjur Secrets Plugin	3	–	Feb 15, 2022
Jenkins Assembla Plugin	3	–	Jun 24, 2026
Jenkins Parameterized Remote Trigger Plugin	3	–	Sep 2, 2026
Jenkins Azure Credentials Plugin	3	–	Feb 15, 2023
Jenkins Liquibase Runner Plugin	3	–	Sep 23, 2020
Jenkins CloudBees CD Plugin	3	–	Oct 25, 2023
Jenkins Lucene-Search Plugin	3	–	Apr 12, 2023
Jenkins Folders Plugin	3	–	Aug 16, 2023
Jenkins OpenID Plugin	3	–	Jan 24, 2023
Jenkins Multijob Plugin	3	–	Aug 5, 2026
Jenkins FitNesse Plugin	3	–	Jun 24, 2026
Jenkins Code Coverage API Plugin	3	–	Aug 31, 2021
Jenkins Fortify on Demand Plugin	3	–	Jul 2, 2020
Jenkins Flaky Test Handler Plugin	3	–	Aug 16, 2023
Jenkins Matrix Authorization Strategy Plugin	3	–	Apr 29, 2026
Jenkins Azure VM Agents Plugin	3	–	May 16, 2023
Jenkins Generic Webhook Trigger Plugin	3	–	Oct 19, 2022
Jenkins Mailer Plugin	3	–	Jan 12, 2022
Jenkins Embeddable Build Status Plugin	3	–	Jun 22, 2022
Jenkins CloudBees AWS Credentials Plugin	3	–	Mar 15, 2022
Jenkins XPath Configuration Viewer Plugin	3	–	Jun 30, 2022
Jenkins ElasTest Plugin	3	–	Sep 16, 2020
Jenkins Zephyr for JIRA Test Management Plugin	3	–	Jul 2, 2020
Jenkins Mac Plugin	3	–	Mar 9, 2020
Jenkins XebiaLabs XL Release Plugin	3	–	Jun 30, 2022
Jenkins OWASP Dependency-Check Plugin	3	–	Sep 16, 2026
Jenkins Support Core Plugin	3	–	Nov 15, 2022
Jenkins EasyQA Plugin	3	–	Jun 22, 2022
Jenkins TestComplete support Plugin	3	–	May 16, 2023
Jenkins Chef Sinatra Plugin	3	–	Feb 15, 2022
Jenkins JUnit Plugin	3	–	Feb 15, 2023
Jenkins TestQuality Updater Plugin	3	–	Jan 24, 2023
Jenkins Semantic Versioning Plugin	3	–	Jan 24, 2023
Jenkins SSH Plugin	3	–	May 17, 2022
Jenkins SAML Plugin	3	–	Sep 2, 2026
Jenkins Warnings Plugin	3	–	Sep 16, 2026
Jenkins Role-based Authorization Strategy Plugin	3	–	Mar 23, 2023
Jenkins Gogs Plugin	3	–	Oct 25, 2023
Jenkins RQM Plugin	3	–	Sep 21, 2022
Jenkins dbCharts Plugin	3	–	Mar 15, 2022
Jenkins GitLab Branch Source Plugin	3	–	Jan 24, 2024
Jenkins Openstack Heat Plugin	3	–	Jul 27, 2022
Jenkins database Plugin	3	–	Sep 1, 2020
Jenkins CVS Plugin	3	–	Apr 12, 2022
Jenkins GitHub Pull Request Builder Plugin	3	–	Jan 24, 2023
Jenkins Publish to Bitbucket Plugin	3	–	Oct 29, 2025
Jenkins Build-Publisher Plugin	3	–	Sep 21, 2022
Jenkins Applitools Eyes Plugin	3	–	Jul 9, 2025
Jenkins GitHub Plugin	3	–	Apr 29, 2026
Jenkins Keycloak Authentication Plugin	3	–	Sep 16, 2026
Jenkins Recipe Plugin	3	–	Jun 30, 2022
Jenkins S3 publisher Plugin	3	–	May 11, 2021
Jenkins MATLAB Plugin	3	–	Nov 29, 2023
Jenkins RocketChat Notifier Plugin	3	–	Jun 30, 2022
Jenkins Curseforge Publisher Plugin	2	–	Oct 29, 2025
Jenkins autonomiq Plugin	2	–	Feb 15, 2022
Jenkins build-metrics Plugin	2	–	Jun 30, 2022
Jenkins Plot Plugin	2	–	Dec 7, 2022
Jenkins Pipeline Utility Steps Plugin	2	–	May 16, 2023
Jenkins Promoted Builds (Simple) Plugin	2	–	May 17, 2022
Jenkins Coverage/Complexity Scatter Plot Plugin	2	–	Mar 29, 2022
Jenkins Coverage Plugin	2	–	Sep 16, 2026
Jenkins Pipeline: Input Step Plugin	2	–	Oct 19, 2022
Jenkins Apica Loadtest Plugin	2	–	Jul 9, 2025
Jenkins Convert To Pipeline Plugin	2	–	Mar 23, 2023
Jenkins Consul KV Builder Plugin	2	–	Apr 12, 2023
Jenkins BigPanda Notifier Plugin	2	–	Sep 21, 2022
Jenkins Perfecto Plugin	2	–	Sep 16, 2020
Jenkins Benchmark Evaluator Plugin	2	–	Jul 12, 2023
Jenkins Agent Server Parameter Plugin	2	–	Jun 22, 2022
Jenkins Compuware Xpediter Code Coverage Plugin	2	–	Oct 19, 2022
Jenkins Git server Plugin	2	–	May 2, 2024
Jenkins Compuware Topaz Utilities Plugin	2	–	Oct 19, 2022
Jenkins BearyChat Plugin	2	–	Jan 24, 2023
Jenkins Beaker builder Plugin	2	–	Jun 22, 2022
Jenkins OpsGenie Plugin	2	–	Jun 30, 2022
Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin	2	–	Oct 19, 2022
Jenkins Frugal Testing Plugin	2	–	Sep 6, 2023
Jenkins Compuware ISPW Operations Plugin	2	–	Jul 27, 2022
Jenkins Assembla Auth Plugin	2	–	Sep 6, 2023
Jenkins OWASP Dependency-Track Plugin	2	–	Mar 30, 2021
Jenkins Performance Plugin	2	–	Sep 2, 2026
Jenkins Publish Over FTP Plugin	2	–	Apr 12, 2022
Jenkins Folder-based Authorization Strategy Plugin	2	–	Jan 22, 2025
Jenkins NUnit Plugin	2	–	Oct 19, 2022
Jenkins Nouvola DiveCloud Plugin	2	–	Jul 9, 2025
Jenkins AsakusaSatellite Plugin	2	–	Apr 2, 2025
Jenkins Nexus Task Runner Plugin	2	–	Oct 29, 2025
Jenkins Filesystem List Parameter Plugin	2	–	Nov 27, 2024
Jenkins MongoDB Plugin	2	–	Sep 16, 2020
Jenkins File Parameter Plugin	2	–	Sep 2, 2026
Jenkins Microsoft Entra ID (previously Azure AD) Plugin	2	–	Sep 2, 2026
Jenkins Nested View Plugin	2	–	Jun 22, 2022
Jenkins Failed Job Deactivator Plugin	2	–	Jun 30, 2022
Jenkins Maven Repository Server Plugin	2	–	Jun 14, 2023
Jenkins Artifactory Plugin	2	–	Mar 25, 2020
Jenkins Cobertura Plugin	2	–	Mar 9, 2020
Jenkins Maven Metadata Plugin for Jenkins CI server Plugin	2	–	Jul 27, 2022
Jenkins MCP Server Plugin	2	–	Jun 24, 2026
Jenkins OpenShift Login Plugin	2	–	Jul 12, 2023
Jenkins Cluster Statistics Plugin	2	–	Nov 15, 2022
Jenkins External Workspace Manager Plugin	2	–	Aug 5, 2026
Jenkins External Monitor Job Type Plugin	2	–	Jul 12, 2023
Jenkins Azure Service Fabric Plugin	2	–	Jan 22, 2025
Jenkins Gatling Plugin	2	–	Jun 6, 2025
Jenkins Matrix Reloaded Plugin	2	–	Jun 30, 2022
Jenkins Gerrit Trigger Plugin	2	–	Jan 24, 2023
Jenkins LoadNinja Plugin	2	–	Mar 18, 2026
Jenkins ElasticBox CI Plugin	2	–	Jul 12, 2023
Jenkins Claim Plugin	2	–	Feb 24, 2021
Jenkins lambdatest-automation Plugin	2	–	Oct 25, 2023
Jenkins Azure Key Vault Plugin	2	–	Apr 12, 2023

Exploited and recent CVEs

CVE-2024-23897 Critical 9.8 Exploited Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, 100.0%
CVE-2019-1003030 Critical 9.9 Exploited A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to 97.1%
CVE-2019-1003029 Critical 9.9 Exploited A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenk 74.4%
CVE-2026-117626 Medium 4.3 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with 0.3%
CVE-2026-117625 Medium 4.3 A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the conf 0.2%
CVE-2026-117624 High 8.8 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level config 0.4%
CVE-2026-117623 Medium 5.4 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerabilit 0.3%
CVE-2026-117622 Medium 6.1 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnera 0.3%
CVE-2026-117621 Medium 6.1 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulne 0.3%
CVE-2026-117620 High 8.8 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject a 0.4%
CVE-2026-117619 High 8.1 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who 0.3%
CVE-2026-117618 High 8.1 In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition t 0.3%
CVE-2026-117617 High 8.1 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows 0.5%
CVE-2026-117616 High 8.8 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.x 0.6%
CVE-2026-117615 Medium 6.5 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read 0.4%
CVE-2026-117614 High 8.8 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they 0.4%
CVE-2026-117613 Medium 5.4 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted 0.3%
CVE-2026-117612 High 8.8 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization. 0.4%
CVE-2026-92141 Medium 4.3 Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks. 0.3%
CVE-2026-92140 Medium 6.8 Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exp 0.4%
CVE-2026-92139 Medium 6.5 Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those UR 0.2%
CVE-2026-92138 Medium 4.2 The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather than from the server-side stored request 0.1%
CVE-2026-92137 High 8.8 Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller 0.8%
CVE-2026-92136 High 8.0 Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability explo 0.4%
CVE-2026-92135 High 8.0 Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure pe 0.4%
CVE-2026-92134 High 8.0 Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configu 0.4%
CVE-2026-92133 Medium 5.4 Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omittin 0.2%
CVE-2026-92132 Medium 5.4 Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global c 0.3%
CVE-2026-92131 Medium 4.2 Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follow 0.2%
CVE-2026-92130 Low 3.1 Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure 0.2%