94
CVEs
15
Critical
31
High
0
KEV
1
PoC
45
Unpatched C/H
2.1%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
15
HIGH
31
MEDIUM
43
LOW
4
Monthly CVE Trend
Affected Products (30)
Java
164
Openshift
41
Openshift Container Platform
33
Script Security
31
Pipeline
26
Kubernetes
25
Communications Cloud Native Core Automated Test Suite
17
Open Redirect
16
Jenkins Script Security Plugin
13
Docker
13
Git
11
Blue Ocean
11
Session Fixation
10
Email Extension
10
Build Failure Analyzer
10
Cloudbees
9
Active Directory
9
Ns Nd Integration Performance Publisher
8
Configuration As Code
8
Openshift Deployer
7
Rundeck
7
Saml Single Sign On
7
Jervis
7
Config File Provider
7
Openid Connect Authentication
7
Jenkins Pipeline
7
Subversion
7
Amazon Ec2
6
Pipeline Maven Integration
6
Project Inheritance
6
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-55537 | Server-Side Request Forgery in PraisonAI's Jobs API (pip/praisonai < 4.6.58) results from two compounding flaws: a fail-open DNS error handler in `JobSubmitRequest.validate_webhook_url()` that silently accepts any webhook URL when `socket.gaierror` is raised, and a TOCTOU race where `JobExecutor._send_webhook()` performs a completely independent DNS resolution via `httpx.AsyncClient` minutes to hours after validation. Authenticated attackers with a valid API bearer token can submit a job whose `webhook_url` hostname returns NXDOMAIN at validation time, then update DNS to a private IP before job completion, causing the executor to POST job result data to internal infrastructure. A detailed proof-of-concept is publicly available in GHSA-rg5q-pp8p-f7jm; no public exploit identified at time of analysis beyond the PoC, and this CVE is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 56 |
PoC
|
| CVE-2026-70426 | Remote code execution on the Jenkins controller is achievable by attackers holding Agent/Connect permission via a JEP-200 deserialization filter bypass in the Remoting library (agent.jar/remoting.jar). Jenkins 2.575 and earlier, and LTS 2.568.1 and earlier, include a Remoting version (3384.v60d89463d9e0 and earlier, except the backport 3355.3357.v931d3c992987) that fails to apply the JEP-200 class filter to a fallback deserialization code path, allowing crafted serialized Java objects to reach classes on the Jenkins core classpath that are not blocked by the pre-JEP-200 denylist. No public exploit or CISA KEV listing has been identified at time of analysis, but the primitive - controller-side code execution triggered from an agent - represents a critical trust-boundary violation in Jenkins' controller-agent architecture. | CRITICAL | 9.0 | 0.3% | 45 |
No patch
|
| CVE-2026-84645 | Remote code execution in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows any low-privileged authenticated user to compromise the Jenkins controller by submitting a crafted `config.xml` document. The document embeds objects that Jenkins treats as independent top-level configuration types - such as job definitions or global settings - as nested field values; once bound into Jenkins' runtime object graph, Stapler (Jenkins' HTTP routing framework) begins dispatching live HTTP requests through those embedded objects, providing an attacker-controlled code execution path. Vendor-released patches (Jenkins 2.580, LTS 2.568.3) are available as of 2026-09-02; no KEV listing or public POC is confirmed at time of analysis. | HIGH | 8.8 | 0.7% | 45 |
No patch
|
| CVE-2026-92122 | Sandbox escape in the Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier lets an authenticated user who holds permission to define and run sandboxed scripts - including Pipelines - execute arbitrary code in the Jenkins controller JVM, earning a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a protection-mechanism failure (CWE-693): the sandbox proxy created when a script coerces a value to a Java interface skips the method check when the coerced value inherits a same-named method, so the interface proxy can be used to reach unchecked code. No public exploit code has been identified at time of analysis and CISA SSVC rates the issue non-automatable (Exploitation: none, Automatable: no, Technical Impact: total), so mass exploitation is not expected; the binding prerequisite is the authenticated script-authoring permission reflected by PR:L, which makes this a real but privilege-gated RCE-class risk. | HIGH | 8.8 | 0.6% | 45 |
No patch
|
| CVE-2026-92123 | Sandbox escape in the Jenkins Script Security Plugin (1415.v9a_f9b_3a_c253d and earlier) allows authenticated users with permission to define and run sandboxed Groovy or Pipeline scripts to execute arbitrary code in the Jenkins controller JVM, because the sandbox fails to intercept method calls, property and attribute accesses, and array accesses made on a null receiver. No non-default configuration is required - the weakness is inherent to the default sandbox - and the flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-693), with CISA SSVC assessing total technical impact but no active exploitation and no public exploit identified at time of analysis. Real-world urgency is moderated by the access prerequisite: the attacker must already hold script-authoring rights, so exposure is concentrated in multi-tenant or delegated Jenkins instances where Pipeline authoring is granted to less-trusted users. | HIGH | 8.8 | 0.6% | 45 |
No patch
|
| CVE-2026-92124 | Arbitrary code execution in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier allows an authenticated attacker with permission to define and run sandboxed Groovy scripts or Pipelines to bypass the sandbox and run code in the Jenkins controller JVM. The flaw is a protection mechanism failure (CWE-693) in how the plugin casts collections, and it carries CVSS 8.8 with PR:L; only users who can author sandboxed scripts or Pipelines can trigger it. No public exploit code was identified at time of analysis, and CISA SSVC rates exploitation as none, but this is high-priority for multi-tenant Jenkins because script-authoring rights are often broadly granted. | HIGH | 8.8 | 0.6% | 45 |
No patch
|
| CVE-2026-84671 | Arbitrary file write to remote code execution in Jenkins File Parameter Plugin (versions ≤ 425.v3fa_801681b_5e) is achievable by any low-privilege authenticated Jenkins user through a Stapler data binding flaw. By crafting a build request with a path-traversal file parameter, an attacker can write attacker-controlled content to arbitrary locations on the Jenkins controller filesystem, enabling code execution by overwriting Groovy init scripts, SSH authorized_keys, or other sensitive files. No public exploit has been identified at time of analysis, and CISA SSVC rates current exploitation as none - but the technical impact ceiling is total controller compromise. | HIGH | 8.8 | 0.6% | 45 |
No patch
|
| CVE-2026-92125 | Sandbox escape leading to arbitrary code execution inside the Jenkins controller JVM affects Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier because the plugin fails to reject the @GroovyASTTransformationClass annotation in script source. An authenticated Jenkins user with permission to define and run sandboxed scripts, including Pipelines (the CVSS vector carries PR:L), can submit a script that registers a Groovy AST transformation executed at compile time, before the sandbox applies, resulting in high confidentiality, integrity, and availability impact on the controller; our independent assessment scores this 8.8 with a scope change (S:C) rather than the provider's S:U. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but for any account holding script-submission rights the exploit path is direct rather than theoretical, so the practical risk concentrates on instances that grant Job/Configure or equivalent Pipeline-authoring rights broadly. This is a genuine high-priority vulnerability, not CVSS inflation: the sandbox itself, not a misconfiguration, is the control being bypassed. | HIGH | 8.8 | 0.5% | 45 |
No patch
|
| CVE-2026-84647 | Unsafe type instantiation during form data binding in Jenkins Stapler allows low-privileged authenticated users to trigger instantiation of arbitrary object types unrelated to the intended field type, achieving full compromise (C:H/I:H/A:H) of the Jenkins controller. Affected are Jenkins 2.579 and earlier and LTS 2.568.2 and earlier, via Stapler 2107.v8dfcb_e8ed317 and earlier (excluding the backport 2088.2093.vd7c3e58008a_6). The root cause is CWE-502-class unsafe deserialization/type-binding: Stapler fails to constrain which Java types may be instantiated when processing attacker-controlled HTTP form submissions. No public exploit code or CISA KEV listing is identified at time of analysis, but Jenkins is pervasively deployed in CI/CD pipelines and the low privilege bar (Overall/Read) makes this a high-priority patch target. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-70431 | Unsandboxed Groovy script execution in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows any attacker holding Item/Create or Item/Configure permission to run arbitrary code directly on the Jenkins controller JVM. The plugin exposes Groovy scripting capabilities that intentionally bypass the Script Security Plugin - the standard Jenkins mechanism for confining script execution to a restricted sandbox - meaning scripts execute with the full privileges of the Jenkins service account. The fix is available in Multijob Plugin 677.v7ffc23d6a_4c2; no public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-84670 | Unrestricted Java deserialization in Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier enables any user holding Item/Configure permission to execute arbitrary code on the Jenkins controller. The plugin stores performance test results as serialized Java objects in the build directory and reads them back without enforcing a class allowlist, enabling classic gadget-chain exploitation (CWE-502). No public exploit has been identified at time of analysis, and SSVC rates exploitation as none with non-automatable delivery, but technical impact is rated total - full Jenkins controller compromise. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-84669 | Path traversal in Jenkins Allure Plugin 2.35.2 and earlier allows any user holding Item/Read permission on a Jenkins job that publishes Allure test reports to read arbitrary files from the Jenkins controller's filesystem, including credentials, configuration files, and secrets stored on the controller. The vulnerability is reachable over the network with only low-level authenticated access - a standard privilege held by most Jenkins users in typical multi-user deployments. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation as none currently, though technical impact is rated total given unconstrained file read on the controller. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-84650 | Unsafe Java deserialization in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows authenticated users with configuration-submission permissions to control the values of transient fields during deserialization, with impact ranging up to full server compromise depending on how those fields are used internally. Transient fields in Java are normally excluded from serialization to protect derived or sensitive state; this flaw breaks that guarantee when processing externally supplied configuration data. No public exploit code or active exploitation has been confirmed at time of analysis, but given Jenkins' role as a CI/CD orchestrator with broad network access and secrets, the blast radius of exploitation is significant. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-84648 | Stored XSS in Jenkins' system log viewer exposes administrators and privileged users to session hijacking and UI redress attacks, exploitable by any attacker who controls a Jenkins agent process. The vulnerability affects Jenkins 2.579 and earlier (including LTS 2.568.2 and earlier), where log record metadata - source, level, and timestamp - is rendered in the browser without HTML escaping, allowing persistent JavaScript injection via agent-controlled log channels. Patch versions 2.580 (weekly) and LTS 2.568.3 are available per the Jenkins security advisory SECURITY-3967; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-84673 | Stored cross-site scripting in Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows authenticated attackers with permission to modify plugin appearance settings to inject persistent JavaScript payloads via a crafted SVG icon, executing in the browser context of any Jenkins user who loads the affected header. Because the header renders on every Jenkins page, a single write operation by a low-privileged attacker broadly affects all platform users, including administrators. No public exploit code has been identified at time of analysis, and SSVC categorizes exploitation as none, though technical impact is rated total. | HIGH | 8.8 | 0.3% | 44 |
No patch
|