34
CVEs
0
Critical
16
High
0
KEV
1
PoC
15
Unpatched C/H
2.9%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
16
MEDIUM
17
LOW
1
Monthly CVE Trend
Affected Products (30)
Java
150
Openshift
41
Openshift Container Platform
33
Script Security
31
Kubernetes
25
Pipeline
25
Communications Cloud Native Core Automated Test Suite
17
Open Redirect
15
Docker
13
Blue Ocean
11
Git
11
Build Failure Analyzer
10
Session Fixation
10
Email Extension
9
Cloudbees
9
Ns Nd Integration Performance Publisher
8
Configuration As Code
8
Openid Connect Authentication
7
Openshift Deployer
7
Subversion
7
Saml Single Sign On
7
Jervis
7
Config File Provider
7
Active Directory
7
Rundeck
7
Electricflow
6
Deployment Dashboard
6
Job Configuration History
6
Pipeline Maven Integration
6
Repository Connector
6
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-55537 | Server-Side Request Forgery in PraisonAI's Jobs API (pip/praisonai < 4.6.58) results from two compounding flaws: a fail-open DNS error handler in `JobSubmitRequest.validate_webhook_url()` that silently accepts any webhook URL when `socket.gaierror` is raised, and a TOCTOU race where `JobExecutor._send_webhook()` performs a completely independent DNS resolution via `httpx.AsyncClient` minutes to hours after validation. Authenticated attackers with a valid API bearer token can submit a job whose `webhook_url` hostname returns NXDOMAIN at validation time, then update DNS to a private IP before job completion, causing the executor to POST job result data to internal infrastructure. A detailed proof-of-concept is publicly available in GHSA-rg5q-pp8p-f7jm; no public exploit identified at time of analysis beyond the PoC, and this CVE is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 56 |
PoC
|
| CVE-2026-84645 | Remote code execution in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows any low-privileged authenticated user to compromise the Jenkins controller by submitting a crafted `config.xml` document. The document embeds objects that Jenkins treats as independent top-level configuration types - such as job definitions or global settings - as nested field values; once bound into Jenkins' runtime object graph, Stapler (Jenkins' HTTP routing framework) begins dispatching live HTTP requests through those embedded objects, providing an attacker-controlled code execution path. Vendor-released patches (Jenkins 2.580, LTS 2.568.3) are available as of 2026-09-02; no KEV listing or public POC is confirmed at time of analysis. | HIGH | 8.8 | 0.7% | 45 |
No patch
|
| CVE-2026-84671 | Arbitrary file write to remote code execution in Jenkins File Parameter Plugin (versions ≤ 425.v3fa_801681b_5e) is achievable by any low-privilege authenticated Jenkins user through a Stapler data binding flaw. By crafting a build request with a path-traversal file parameter, an attacker can write attacker-controlled content to arbitrary locations on the Jenkins controller filesystem, enabling code execution by overwriting Groovy init scripts, SSH authorized_keys, or other sensitive files. No public exploit has been identified at time of analysis, and CISA SSVC rates current exploitation as none - but the technical impact ceiling is total controller compromise. | HIGH | 8.8 | 0.6% | 45 |
No patch
|
| CVE-2026-84647 | Unsafe type instantiation during form data binding in Jenkins Stapler allows low-privileged authenticated users to trigger instantiation of arbitrary object types unrelated to the intended field type, achieving full compromise (C:H/I:H/A:H) of the Jenkins controller. Affected are Jenkins 2.579 and earlier and LTS 2.568.2 and earlier, via Stapler 2107.v8dfcb_e8ed317 and earlier (excluding the backport 2088.2093.vd7c3e58008a_6). The root cause is CWE-502-class unsafe deserialization/type-binding: Stapler fails to constrain which Java types may be instantiated when processing attacker-controlled HTTP form submissions. No public exploit code or CISA KEV listing is identified at time of analysis, but Jenkins is pervasively deployed in CI/CD pipelines and the low privilege bar (Overall/Read) makes this a high-priority patch target. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-84670 | Unrestricted Java deserialization in Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier enables any user holding Item/Configure permission to execute arbitrary code on the Jenkins controller. The plugin stores performance test results as serialized Java objects in the build directory and reads them back without enforcing a class allowlist, enabling classic gadget-chain exploitation (CWE-502). No public exploit has been identified at time of analysis, and SSVC rates exploitation as none with non-automatable delivery, but technical impact is rated total - full Jenkins controller compromise. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-84669 | Path traversal in Jenkins Allure Plugin 2.35.2 and earlier allows any user holding Item/Read permission on a Jenkins job that publishes Allure test reports to read arbitrary files from the Jenkins controller's filesystem, including credentials, configuration files, and secrets stored on the controller. The vulnerability is reachable over the network with only low-level authenticated access - a standard privilege held by most Jenkins users in typical multi-user deployments. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation as none currently, though technical impact is rated total given unconstrained file read on the controller. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-84650 | Unsafe Java deserialization in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows authenticated users with configuration-submission permissions to control the values of transient fields during deserialization, with impact ranging up to full server compromise depending on how those fields are used internally. Transient fields in Java are normally excluded from serialization to protect derived or sensitive state; this flaw breaks that guarantee when processing externally supplied configuration data. No public exploit code or active exploitation has been confirmed at time of analysis, but given Jenkins' role as a CI/CD orchestrator with broad network access and secrets, the blast radius of exploitation is significant. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-84648 | Stored XSS in Jenkins' system log viewer exposes administrators and privileged users to session hijacking and UI redress attacks, exploitable by any attacker who controls a Jenkins agent process. The vulnerability affects Jenkins 2.579 and earlier (including LTS 2.568.2 and earlier), where log record metadata - source, level, and timestamp - is rendered in the browser without HTML escaping, allowing persistent JavaScript injection via agent-controlled log channels. Patch versions 2.580 (weekly) and LTS 2.568.3 are available per the Jenkins security advisory SECURITY-3967; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-84673 | Stored cross-site scripting in Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows authenticated attackers with permission to modify plugin appearance settings to inject persistent JavaScript payloads via a crafted SVG icon, executing in the browser context of any Jenkins user who loads the affected header. Because the header renders on every Jenkins page, a single write operation by a low-privileged attacker broadly affects all platform users, including administrators. No public exploit code has been identified at time of analysis, and SSVC categorizes exploitation as none, though technical impact is rated total. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-84668 | Authentication bypass in the Jenkins SAML Plugin (all versions through 4.618.v441a_27fa_46d2) allows any authenticated low-privilege user to overwrite the SAML identity provider metadata file via unrestricted Stapler data binding, replacing it with attacker-controlled content. Once the IdP metadata is replaced, the attacker operates their own SAML authority and can issue assertions claiming any Jenkins user identity - including administrator - granting full platform compromise. No active exploitation is confirmed (not in CISA KEV), and no public POC has been identified at time of analysis. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-84672 | Privilege escalation in Jenkins Microsoft Entra ID Plugin (≤710.v0b_ff8e9cc2d2) allows any Entra tenant member with group-creation rights to inherit Jenkins permissions configured for a privileged group by creating a new Entra group whose display name collides with a privileged group's display name. The plugin incorrectly resolves group identity using both the immutable object ID and the mutable, user-controllable display name, so the collision satisfies the authorization check without the attacker belonging to the legitimate privileged group. No public exploit has been identified and CISA has not listed this in KEV, but exploitation requires only a valid Entra account, making it a meaningful insider or tenant-level escalation path into CI/CD infrastructure. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-84649 | CSRF token leakage in Jenkins allows an attacker who controls any same-origin page on the Jenkins controller to silently steal a valid CSRF crumb from an authenticated user's session and forge privileged requests on their behalf. The vulnerability spans Jenkins 2.447-2.579 (weekly) and LTS 2.452.1-2.568.2 via the bundled Stapler web framework, which embeds the session crumb as a plaintext string literal inside dynamically generated JavaScript responses. No public exploit or CISA KEV listing is present at time of analysis, but successful exploitation yields full account-level action forgery against any authenticated victim who visits the attacker-controlled page. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-84665 | Stored cross-site scripting in Jenkins SonarQube Scanner Plugin ≤2.18.3 allows attackers holding Item/Configure permission to inject javascript: scheme URLs into dashboard links the plugin constructs from SonarQube scanner results. The plugin performs no URL-scheme validation, so a malicious javascript: payload persists in the Jenkins UI and executes in any victim's browser that views or interacts with the affected dashboard link. No public exploit or active exploitation has been identified at time of analysis; the Jenkins security team confirmed and published this issue on 2026-09-02. | HIGH | 8.0 | 0.2% | 40 |
No patch
|
| CVE-2026-84675 | OS command injection in Jenkins TICS Plugin 2025.1.1 and earlier allows an authenticated, low-privileged Jenkins user who can control build environment variable values to execute arbitrary commands on the build agent hosting the job. The flaw stems from unsanitized environment variable values being passed directly to OS command invocations within the plugin, and the scope change (S:C) means impact falls on the agent node rather than the Jenkins controller. No public exploit code exists and SSVC rates exploitation status as none with non-automatable attack path, placing real-world priority lower than the raw CVSS score suggests. | HIGH | 7.4 | 1.2% | 38 |
No patch
|
| CVE-2026-84652 | Session fixation in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows an attacker who can serve content on the same site as Jenkins to inject a known session cookie into a victim's browser; when the victim subsequently authenticates via the persistent 'remember me' cookie without session rotation, the attacker inherits the fully authenticated session. The attack chain requires low-privilege same-site content delivery access and active victim participation in a remember-me login flow, meaningfully constraining real-world exploitability. Vendor patches (Jenkins 2.580 and LTS 2.568.3) are available per the Jenkins Security Advisory published 2026-09-02; no public exploit code or CISA KEV listing exists at time of analysis. | HIGH | 7.3 | 0.2% | 37 |
No patch
|