Vulnerabilities of Jenkins project Jenkins Script Security Plugin
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-92129 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to… | 7.5 High | Sep 16, 2026 |
| CVE-2026-92127 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item… | 8.0 High | Sep 16, 2026 |
| CVE-2026-92128 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming… | 7.5 High | Sep 16, 2026 |
| CVE-2026-92125 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass… | 8.8 High | Sep 16, 2026 |
| CVE-2026-92126 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose… | 7.2 High | Sep 16, 2026 |
| CVE-2026-92124 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the… | 8.8 High | Sep 16, 2026 |
| CVE-2026-92123 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null… | 8.8 High | Sep 16, 2026 |
| CVE-2026-92122 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy… | 8.8 High | Sep 16, 2026 |
| CVE-2026-84658 | Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a… | 4.3 Medium | Sep 2, 2026 |
| CVE-2026-84659 | Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that… | 4.3 Medium | Sep 2, 2026 |
| CVE-2026-57280 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to… | 8.8 High | Jun 24, 2026 |
| CVE-2026-57281 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations… | 7.5 High | Jun 24, 2026 |
| CVE-2026-42519 | A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with… | 4.3 Medium | Apr 29, 2026 |
| CVE-2024-52549 | Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and… | 4.3 Medium | Nov 13, 2024 |
| CVE-2024-34145 | A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in… | 8.8 High | May 2, 2024 |
| CVE-2024-34144 | A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin… | 9.8 Critical | May 2, 2024 |
| CVE-2023-24422 | A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and… | 8.8 High | Jan 24, 2023 |
| CVE-2022-45379 | Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of… | Not rated | Nov 15, 2022 |
| CVE-2022-43404 | A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic… | Not rated | Oct 19, 2022 |
| CVE-2022-43403 | A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security… | Not rated | Oct 19, 2022 |
| CVE-2022-43401 | A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins… | Not rated | Oct 19, 2022 |
| CVE-2022-30946 | A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier… | Not rated | May 17, 2022 |
| CVE-2020-2279 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to… | Not rated | Sep 23, 2020 |
| CVE-2020-2190 | Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the… | Not rated | Jun 3, 2020 |
| CVE-2020-2134 | Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted… | Not rated | Mar 9, 2020 |
Other Jenkins project products
Jenkins 153
Jenkins Pipeline: Groovy Plugin 11
Jenkins Active Directory Plugin 11
Jenkins Email Extension Plugin 9
Jenkins GitLab Plugin 8
Jenkins Build Failure Analyzer Plugin 8
Jenkins Job Configuration History Plugin 8
Jenkins OpenId Connect Authentication Plugin 8
Jenkins NS-ND Integration Performance Publisher Plugin 8
Jenkins Pipeline: Shared Groovy Libraries Plugin 8
Jenkins OpenShift Deployer Plugin 7
Jenkins Amazon EC2 Plugin 7