Known vulnerabilities in Jenkins
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2025-67635 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the… | 7.5 High | Dec 10, 2025 |
| CVE-2025-59476 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted… | 5.3 Medium | Sep 17, 2025 |
| CVE-2025-59475 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user… | 4.3 Medium | Sep 17, 2025 |
| CVE-2025-59474 | Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page… | 5.3 Medium | Sep 17, 2025 |
| CVE-2025-31721 | A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create… | 4.3 Medium | Apr 2, 2025 |
| CVE-2025-31720 | A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create… | 4.3 Medium | Apr 2, 2025 |
| CVE-2025-27625 | In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered… | 4.3 Medium | Mar 5, 2025 |
| CVE-2025-27624 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers… | 5.4 Medium | Mar 5, 2025 |
| CVE-2025-27623 | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing… | 4.3 Medium | Mar 5, 2025 |
| CVE-2025-27622 | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing… | 4.3 Medium | Mar 5, 2025 |
| CVE-2024-47804 | If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or… | 4.3 Medium | Oct 2, 2024 |
| CVE-2024-47803 | Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages… | 4.3 Medium | Oct 2, 2024 |
| CVE-2024-43045 | Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing… | 6.3 Medium | Aug 7, 2024 |
| CVE-2024-43044 | Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins… | 8.8 High | Aug 7, 2024 |
| CVE-2024-23898 | Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin… | 8.8 High | Jan 24, 2024 |
| CVE-2024-23897 | Exploited Jenkins Command Line Interface (CLI) Path Traversal Vulnerability | 9.8 Critical | Jan 24, 2024 |
| CVE-2023-43498 | In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates… | Not rated | Sep 20, 2023 |
| CVE-2023-43497 | In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates… | Not rated | Sep 20, 2023 |
| CVE-2023-43496 | Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the… | 8.8 High | Sep 20, 2023 |
| CVE-2023-43495 | Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of… | Not rated | Sep 20, 2023 |
| CVE-2023-43494 | Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive… | Not rated | Sep 20, 2023 |
| CVE-2023-39151 | Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when… | Not rated | Jul 26, 2023 |
| CVE-2023-35141 | In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context… | 8.0 High | Jun 14, 2023 |
| CVE-2023-27904 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent… | 5.3 Medium | Mar 8, 2023 |
| CVE-2023-27903 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with… | 4.4 Medium | Mar 8, 2023 |
Other Jenkins project products
Jenkins Script Security Plugin 39
Jenkins Active Directory Plugin 11
Jenkins Pipeline: Groovy Plugin 11
Jenkins Email Extension Plugin 9
Jenkins OpenId Connect Authentication Plugin 8
Jenkins Pipeline: Shared Groovy Libraries Plugin 8
Jenkins Build Failure Analyzer Plugin 8
Jenkins NS-ND Integration Performance Publisher Plugin 8
Jenkins GitLab Plugin 8
Jenkins Job Configuration History Plugin 8
Jenkins OpenShift Deployer Plugin 7
Jenkins Amazon EC2 Plugin 7