Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configur…Check if you run itEPSS 0.23%Dec 10, 2025
- Medium5.4Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting…Check if you run itEPSS 0.31%Dec 10, 2025
- Medium5.0Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script genera…Check if you run itEPSS 0.21%Dec 10, 2025
- Low3.5A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.Check if you run itEPSS 0.19%Dec 10, 2025
- Medium4.3Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attac…Check if you run itEPSS 0.16%Dec 10, 2025
- Medium4.3Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be vi…Check if you run itEPSS 0.18%Dec 10, 2025
- Medium4.3A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.Check if you run itEPSS 0.25%Dec 10, 2025
- High7.5Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenti…Check if you run itEPSS 0.56%Dec 10, 2025
- Medium5.3A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm w…Open the advisoryDec 3, 2025
- UnknownJenkins Jenkins Missing AuthorizationPatch nowKEVEPSS 4.91%Oct 17, 2025
- UnknownJenkins gitlab_hook Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 92.79%Jun 7, 2025
- High8.0Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641 and 1.625, resultingCheck if you run itEPSS 0.54%Jun 6, 2025
- Critical9.8In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log inCheck if you run itEPSS 0.65%May 14, 2025
- Medium5.9Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks.Check if you run itEPSS 0.23%May 14, 2025
- Medium4.3Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifieCheck if you run itEPSS 0.33%May 14, 2025
- Medium4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers to connect to an attacker-specified URLCheck if you run itEPSS 0.25%May 14, 2025
- High8.8Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scriptiCheck if you run itEPSS 0.56%May 14, 2025
- Critical9.1In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunctionCheck if you run itEPSS 0.64%May 14, 2025
- UnknownJenkins github Exposure of Sensitive Information to an Unauthorized ActorPatch nowKEVEPSS 90.89%Sep 19, 2024
- UnknownPipeline: Groovy Plugin 2.61 and earlier Sandbox BypassPatch nowKEVEPSS 86.05%Apr 15, 2024
- Critical9.8Jenkins Command Line Interface (CLI) Path Traversal VulnerabilityPatch nowKEVEPSS 100.00%Jan 24, 2024
- UnknownScript Security Plugin Sandboxed Script Execution VulnerabilityPatch nowKEVEPSS 98.38%Jan 31, 2020
- Critical9.9Jenkins Matrix Project Plugin Remote Code Execution VulnerabilityPatch nowKEVEPSS 97.06%Mar 8, 2019
- Critical9.9Jenkins Script Security Plugin Sandbox Bypass VulnerabilityPatch nowKEVEPSS 74.44%Mar 8, 2019
- Critical9.8Jenkins Stapler Web Framework Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 98.33%Dec 10, 2018