CVEs published by Jenkins Project

CVEs published by Jenkins Project (CVE Numbering Authority). 20 tracked.

• CVE-2026-70431 HIGH 8.8 Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integra
• CVE-2026-70432 HIGH 8.8 A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier a
• CVE-2026-70429 MEDIUM 6.5 UPGRADE Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names in
• CVE-2026-70439 MEDIUM 6.5 Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers la
• CVE-2026-70448 HIGH 7.1 Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XX
• CVE-2026-70447 MEDIUM 4.3 Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read p
• CVE-2026-70437 LOW 3.7 Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time
• CVE-2026-70440 MEDIUM 5.4 Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field v
• CVE-2026-70441 MEDIUM 5.4 Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build
• CVE-2026-70433 MEDIUM 4.3 Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read pe
• CVE-2026-70436 MEDIUM 4.3 Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and ear
• CVE-2026-70438 MEDIUM 4.3 A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers w
• CVE-2026-70442 MEDIUM 4.3 Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context fo
• CVE-2026-70443 MEDIUM 4.3 Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credent
• CVE-2026-70444 MEDIUM 4.3 A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers
• CVE-2026-70445 MEDIUM 4.3 Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read
• CVE-2026-70446 MEDIUM 4.3 Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read perm
• CVE-2026-70435 MEDIUM 4.2 A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read
• CVE-2026-70430 LOW 2.7 UPGRADE Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instanti
• CVE-2026-70434 MEDIUM 4.2 A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows atta

← Back to latest CVEs