88
CVEs
2
Critical
25
High
0
KEV
1
PoC
26
Unpatched C/H
2.3%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
25
MEDIUM
57
LOW
4
Monthly CVE Trend
Affected Products (30)
Java
150
Openshift
41
Openshift Container Platform
33
Script Security
31
Kubernetes
25
Pipeline
25
Communications Cloud Native Core Automated Test Suite
17
Open Redirect
15
Docker
13
Blue Ocean
11
Git
11
Build Failure Analyzer
10
Session Fixation
10
Email Extension
9
Cloudbees
9
Ns Nd Integration Performance Publisher
8
Configuration As Code
8
Openid Connect Authentication
7
Openshift Deployer
7
Subversion
7
Saml Single Sign On
7
Jervis
7
Config File Provider
7
Active Directory
7
Rundeck
7
Electricflow
6
Deployment Dashboard
6
Job Configuration History
6
Pipeline Maven Integration
6
Repository Connector
6
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-55537 | Server-Side Request Forgery in PraisonAI's Jobs API (pip/praisonai < 4.6.58) results from two compounding flaws: a fail-open DNS error handler in `JobSubmitRequest.validate_webhook_url()` that silently accepts any webhook URL when `socket.gaierror` is raised, and a TOCTOU race where `JobExecutor._send_webhook()` performs a completely independent DNS resolution via `httpx.AsyncClient` minutes to hours after validation. Authenticated attackers with a valid API bearer token can submit a job whose `webhook_url` hostname returns NXDOMAIN at validation time, then update DNS to a private IP before job completion, causing the executor to POST job result data to internal infrastructure. A detailed proof-of-concept is publicly available in GHSA-rg5q-pp8p-f7jm; no public exploit identified at time of analysis beyond the PoC, and this CVE is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 56 |
PoC
|
| CVE-2026-70426 | Remote code execution on the Jenkins controller is achievable by attackers holding Agent/Connect permission via a JEP-200 deserialization filter bypass in the Remoting library (agent.jar/remoting.jar). Jenkins 2.575 and earlier, and LTS 2.568.1 and earlier, include a Remoting version (3384.v60d89463d9e0 and earlier, except the backport 3355.3357.v931d3c992987) that fails to apply the JEP-200 class filter to a fallback deserialization code path, allowing crafted serialized Java objects to reach classes on the Jenkins core classpath that are not blocked by the pre-JEP-200 denylist. No public exploit or CISA KEV listing has been identified at time of analysis, but the primitive - controller-side code execution triggered from an agent - represents a critical trust-boundary violation in Jenkins' controller-agent architecture. | CRITICAL | 9.0 | 0.3% | 45 |
No patch
|
| CVE-2026-84645 | Remote code execution in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows any low-privileged authenticated user to compromise the Jenkins controller by submitting a crafted `config.xml` document. The document embeds objects that Jenkins treats as independent top-level configuration types - such as job definitions or global settings - as nested field values; once bound into Jenkins' runtime object graph, Stapler (Jenkins' HTTP routing framework) begins dispatching live HTTP requests through those embedded objects, providing an attacker-controlled code execution path. Vendor-released patches (Jenkins 2.580, LTS 2.568.3) are available as of 2026-09-02; no KEV listing or public POC is confirmed at time of analysis. | HIGH | 8.8 | 0.7% | 45 |
No patch
|
| CVE-2026-84671 | Arbitrary file write to remote code execution in Jenkins File Parameter Plugin (versions ≤ 425.v3fa_801681b_5e) is achievable by any low-privilege authenticated Jenkins user through a Stapler data binding flaw. By crafting a build request with a path-traversal file parameter, an attacker can write attacker-controlled content to arbitrary locations on the Jenkins controller filesystem, enabling code execution by overwriting Groovy init scripts, SSH authorized_keys, or other sensitive files. No public exploit has been identified at time of analysis, and CISA SSVC rates current exploitation as none - but the technical impact ceiling is total controller compromise. | HIGH | 8.8 | 0.6% | 45 |
No patch
|
| CVE-2026-84647 | Unsafe type instantiation during form data binding in Jenkins Stapler allows low-privileged authenticated users to trigger instantiation of arbitrary object types unrelated to the intended field type, achieving full compromise (C:H/I:H/A:H) of the Jenkins controller. Affected are Jenkins 2.579 and earlier and LTS 2.568.2 and earlier, via Stapler 2107.v8dfcb_e8ed317 and earlier (excluding the backport 2088.2093.vd7c3e58008a_6). The root cause is CWE-502-class unsafe deserialization/type-binding: Stapler fails to constrain which Java types may be instantiated when processing attacker-controlled HTTP form submissions. No public exploit code or CISA KEV listing is identified at time of analysis, but Jenkins is pervasively deployed in CI/CD pipelines and the low privilege bar (Overall/Read) makes this a high-priority patch target. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-57301 | Arbitrary code execution on the Jenkins controller affects the Jenkins OWASP ZAP Plugin version 1.0.7 and earlier, which incorrectly runs build operations on the controller node instead of the designated build agent. An attacker holding Item/Configure permission can leverage this misplaced execution to run arbitrary code in the security context of the controller, escaping agent isolation. No public exploit identified at time of analysis, and CISA SSVC records no known exploitation; EPSS is low at 0.39% (31st percentile). | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-70431 | Unsandboxed Groovy script execution in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows any attacker holding Item/Create or Item/Configure permission to run arbitrary code directly on the Jenkins controller JVM. The plugin exposes Groovy scripting capabilities that intentionally bypass the Script Security Plugin - the standard Jenkins mechanism for confining script execution to a restricted sandbox - meaning scripts execute with the full privileges of the Jenkins service account. The fix is available in Multijob Plugin 677.v7ffc23d6a_4c2; no public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-84670 | Unrestricted Java deserialization in Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier enables any user holding Item/Configure permission to execute arbitrary code on the Jenkins controller. The plugin stores performance test results as serialized Java objects in the build directory and reads them back without enforcing a class allowlist, enabling classic gadget-chain exploitation (CWE-502). No public exploit has been identified at time of analysis, and SSVC rates exploitation as none with non-automatable delivery, but technical impact is rated total - full Jenkins controller compromise. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-57280 | Sandbox bypass in the Jenkins Script Security Plugin (1402.v94c9ce464861 and earlier) lets users who can supply sandboxed Groovy scripts invoke arbitrary constructors, escaping the sandbox to run unrestricted code on the Jenkins controller. The flaw stems from the plugin failing to intercept implicit type casts on elements of typed for-each loops, a subtle gap in its interception logic. Reported by the Jenkins project (SECURITY-3792) with no public exploit identified at time of analysis; EPSS is low at 0.37% and CISA SSVC records no observed exploitation. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-84669 | Path traversal in Jenkins Allure Plugin 2.35.2 and earlier allows any user holding Item/Read permission on a Jenkins job that publishes Allure test reports to read arbitrary files from the Jenkins controller's filesystem, including credentials, configuration files, and secrets stored on the controller. The vulnerability is reachable over the network with only low-level authenticated access - a standard privilege held by most Jenkins users in typical multi-user deployments. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation as none currently, though technical impact is rated total given unconstrained file read on the controller. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-84650 | Unsafe Java deserialization in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows authenticated users with configuration-submission permissions to control the values of transient fields during deserialization, with impact ranging up to full server compromise depending on how those fields are used internally. Transient fields in Java are normally excluded from serialization to protect derived or sensitive state; this flaw breaks that guarantee when processing externally supplied configuration data. No public exploit code or active exploitation has been confirmed at time of analysis, but given Jenkins' role as a CI/CD orchestrator with broad network access and secrets, the blast radius of exploitation is significant. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-84648 | Stored XSS in Jenkins' system log viewer exposes administrators and privileged users to session hijacking and UI redress attacks, exploitable by any attacker who controls a Jenkins agent process. The vulnerability affects Jenkins 2.579 and earlier (including LTS 2.568.2 and earlier), where log record metadata - source, level, and timestamp - is rendered in the browser without HTML escaping, allowing persistent JavaScript injection via agent-controlled log channels. Patch versions 2.580 (weekly) and LTS 2.568.3 are available per the Jenkins security advisory SECURITY-3967; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-84673 | Stored cross-site scripting in Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows authenticated attackers with permission to modify plugin appearance settings to inject persistent JavaScript payloads via a crafted SVG icon, executing in the browser context of any Jenkins user who loads the affected header. Because the header renders on every Jenkins page, a single write operation by a low-privileged attacker broadly affects all platform users, including administrators. No public exploit code has been identified at time of analysis, and SSVC categorizes exploitation as none, though technical impact is rated total. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-84668 | Authentication bypass in the Jenkins SAML Plugin (all versions through 4.618.v441a_27fa_46d2) allows any authenticated low-privilege user to overwrite the SAML identity provider metadata file via unrestricted Stapler data binding, replacing it with attacker-controlled content. Once the IdP metadata is replaced, the attacker operates their own SAML authority and can issue assertions claiming any Jenkins user identity - including administrator - granting full platform compromise. No active exploitation is confirmed (not in CISA KEV), and no public POC has been identified at time of analysis. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-84672 | Privilege escalation in Jenkins Microsoft Entra ID Plugin (≤710.v0b_ff8e9cc2d2) allows any Entra tenant member with group-creation rights to inherit Jenkins permissions configured for a privileged group by creating a new Entra group whose display name collides with a privileged group's display name. The plugin incorrectly resolves group identity using both the immutable object ID and the mutable, user-controllable display name, so the collision satisfies the authorization check without the attacker belonging to the legitimate privileged group. No public exploit has been identified and CISA has not listed this in KEV, but exploitation requires only a valid Entra account, making it a meaningful insider or tenant-level escalation path into CI/CD infrastructure. | HIGH | 8.8 | 0.2% | 44 |
No patch
|