{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Jenkins vulnerabilities","home_page_url":"https://patchfirst.co/vendor/jenkins/","feed_url":"https://patchfirst.co/feed/vendor/jenkins.json","description":"New and newly exploited Jenkins CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-53435","url":"https://patchfirst.co/cve/CVE-2026-53435/","title":"CVE-2026-53435: In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize…","content_text":"Jenkins Project · Jenkins. Not in CISA KEV. EPSS 53.1% (higher than 99% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. Priority 73.2 of 100.","summary":"In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize…","date_published":"2026-06-10T00:00:00.000Z","date_modified":"2026-09-09T12:05:08.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":73.2,"kev":null,"epss":{"score":0.53131,"percentile":0.9898},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Jenkins Project","product":"Jenkins","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2017-1000353#kev","url":"https://patchfirst.co/cve/CVE-2017-1000353/","title":"[KEV] CVE-2017-1000353: Jenkins Remote Code Execution Vulnerability","content_text":"Jenkins · Jenkins. In CISA KEV since 2025-10-02. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.","summary":"Jenkins Remote Code Execution Vulnerability","date_published":"2025-10-02T00:00:00.000Z","date_modified":"2026-06-17T00:59:00.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2025-10-02","ransomware":false},"epss":{"score":0.99679,"percentile":0.99951},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Jenkins","product":"Jenkins","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-59474","url":"https://patchfirst.co/cve/CVE-2025-59474/","title":"CVE-2025-59474: Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page…","content_text":"Jenkins Project · Jenkins. Not in CISA KEV. EPSS 5.0% (higher than 92.2% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. Priority 63.2 of 100.","summary":"Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page…","date_published":"2025-09-17T00:00:00.000Z","date_modified":"2025-11-04T21:13:51.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":63.2,"kev":null,"epss":{"score":0.05004,"percentile":0.92228},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Jenkins Project","product":"Jenkins","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2024-54003","url":"https://patchfirst.co/cve/CVE-2024-54003/","title":"CVE-2024-54003: Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site…","content_text":"Jenkins Project · Jenkins Simple Queue Plugin. Not in CISA KEV. EPSS 80.1% (higher than 99.61% of CVEs). CVSS 8.0 HIGH. Priority 25.5 of 100.","summary":"Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site…","date_published":"2024-11-27T00:00:00.000Z","date_modified":"2024-11-27T19:12:14.000Z","tags":[],"_patchfirst":{"reason":"published","priority":25.5,"kev":null,"epss":{"score":0.801,"percentile":0.99615},"cvss":{"score":8,"severity":"HIGH","version":"3.1"},"vendor":"Jenkins Project","product":"Jenkins Simple Queue Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-23897#kev","url":"https://patchfirst.co/cve/CVE-2024-23897/","title":"[KEV] CVE-2024-23897: Jenkins Command Line Interface (CLI) Path Traversal Vulnerability","content_text":"Jenkins · Jenkins Command Line Interface (CLI). In CISA KEV since 2024-08-19, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 79.9 of 100.","summary":"Jenkins Command Line Interface (CLI) Path Traversal Vulnerability","date_published":"2024-08-19T00:00:00.000Z","date_modified":"2026-06-17T07:13:49.000Z","tags":["kev","ransomware","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2024-08-19","ransomware":true},"epss":{"score":0.99999,"percentile":0.99995},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Jenkins","product":"Jenkins Command Line Interface (CLI)","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-28156","url":"https://patchfirst.co/cve/CVE-2024-28156/","title":"CVE-2024-28156: Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names…","content_text":"Jenkins Project · Jenkins Build Monitor View Plugin. Not in CISA KEV. EPSS 79.3% (higher than 99.6% of CVEs). CVSS 5.4 MEDIUM. Priority 23.7 of 100.","summary":"Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names…","date_published":"2024-03-06T00:00:00.000Z","date_modified":"2025-03-27T21:10:39.000Z","tags":[],"_patchfirst":{"reason":"published","priority":23.7,"kev":null,"epss":{"score":0.7925,"percentile":0.99598},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Jenkins Project","product":"Jenkins Build Monitor View Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-23898","url":"https://patchfirst.co/cve/CVE-2024-23898/","title":"CVE-2024-23898: Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin…","content_text":"Jenkins Project · Jenkins. Not in CISA KEV. EPSS 67.2% (higher than 99.3% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. Priority 31.7 of 100.","summary":"Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin…","date_published":"2024-01-24T00:00:00.000Z","date_modified":"2025-06-20T19:28:50.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":31.7,"kev":null,"epss":{"score":0.67151,"percentile":0.99299},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Jenkins Project","product":"Jenkins","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2023-32986","url":"https://patchfirst.co/cve/CVE-2023-32986/","title":"CVE-2023-32986: Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file…","content_text":"Jenkins Project · Jenkins File Parameter Plugin. Not in CISA KEV. EPSS 60.7% (higher than 99.15% of CVEs). CVSS 8.8 HIGH. Priority 26.0 of 100.","summary":"Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file…","date_published":"2023-05-16T00:00:00.000Z","date_modified":"2025-01-23T20:29:53.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26,"kev":null,"epss":{"score":0.60683,"percentile":0.99146},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Jenkins Project","product":"Jenkins File Parameter Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-32985","url":"https://patchfirst.co/cve/CVE-2023-32985/","title":"CVE-2023-32985: Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form…","content_text":"Jenkins Project · Jenkins Sidebar Link Plugin. Not in CISA KEV. EPSS 72.4% (higher than 99.44% of CVEs). CVSS 4.3 MEDIUM. Priority 22.9 of 100.","summary":"Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form…","date_published":"2023-05-16T00:00:00.000Z","date_modified":"2025-01-23T20:32:17.000Z","tags":[],"_patchfirst":{"reason":"published","priority":22.9,"kev":null,"epss":{"score":0.72358,"percentile":0.99437},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Jenkins Project","product":"Jenkins Sidebar Link Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2015-5317#kev","url":"https://patchfirst.co/cve/CVE-2015-5317/","title":"[KEV] CVE-2015-5317: Jenkins User Interface (UI) Information Disclosure Vulnerability","content_text":"Jenkins · Jenkins User Interface (UI). In CISA KEV since 2023-05-12. ENISA EUVD lists it as exploited. EPSS 23.0% (higher than 97.7% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1592 Gather Victim Host Information. Priority 62.8 of 100.","summary":"Jenkins User Interface (UI) Information Disclosure Vulnerability","date_published":"2023-05-12T00:00:00.000Z","date_modified":"2026-06-17T00:28:55.000Z","tags":["kev","T1190","T1592"],"_patchfirst":{"reason":"kev","priority":62.8,"kev":{"dateAdded":"2023-05-12","ransomware":false},"epss":{"score":0.23003,"percentile":0.97749},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Jenkins","product":"Jenkins User Interface (UI)","techniqueIds":["T1190","T1592"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-25762","url":"https://patchfirst.co/cve/CVE-2023-25762/","title":"CVE-2023-25762: Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the…","content_text":"Jenkins Project · Jenkins Pipeline: Build Step Plugin. Not in CISA KEV. EPSS 82.1% (higher than 99.65% of CVEs). CVSS 5.4 MEDIUM. Priority 23.7 of 100.","summary":"Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the…","date_published":"2023-02-15T00:00:00.000Z","date_modified":"2025-03-19T18:48:35.000Z","tags":[],"_patchfirst":{"reason":"published","priority":23.7,"kev":null,"epss":{"score":0.82131,"percentile":0.99654},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Jenkins Project","product":"Jenkins Pipeline: Build Step Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-36883","url":"https://patchfirst.co/cve/CVE-2022-36883/","title":"CVE-2022-36883: A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds…","content_text":"Jenkins project · Jenkins Git Plugin. Not in CISA KEV. EPSS 7.0% (higher than 94.2% of CVEs). Public exploit code exists. Priority 63.8 of 100.","summary":"A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds…","date_published":"2022-07-27T00:00:00.000Z","date_modified":"2024-08-03T10:14:28.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":63.8,"kev":null,"epss":{"score":0.07005,"percentile":0.94157},"cvss":null,"vendor":"Jenkins project","product":"Jenkins Git Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-34783","url":"https://patchfirst.co/cve/CVE-2022-34783/","title":"CVE-2022-34783: Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting…","content_text":"Jenkins project · Jenkins Plot Plugin. Not in CISA KEV. EPSS 81.8% (higher than 99.64% of CVEs). Priority 19.9 of 100.","summary":"Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting…","date_published":"2022-06-30T00:00:00.000Z","date_modified":"2024-08-03T09:22:10.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.9,"kev":null,"epss":{"score":0.81756,"percentile":0.99644},"cvss":null,"vendor":"Jenkins project","product":"Jenkins Plot Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-34777","url":"https://patchfirst.co/cve/CVE-2022-34777/","title":"CVE-2022-34777: Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of…","content_text":"Jenkins project · Jenkins GitLab Plugin. Not in CISA KEV. EPSS 73.6% (higher than 99.47% of CVEs). Priority 19.9 of 100.","summary":"Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of…","date_published":"2022-06-30T00:00:00.000Z","date_modified":"2024-08-03T09:22:10.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.9,"kev":null,"epss":{"score":0.73586,"percentile":0.99467},"cvss":null,"vendor":"Jenkins project","product":"Jenkins GitLab Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-34176","url":"https://patchfirst.co/cve/CVE-2022-34176/","title":"CVE-2022-34176: Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a…","content_text":"Jenkins project · Jenkins JUnit Plugin. Not in CISA KEV. EPSS 77.5% (higher than 99.56% of CVEs). Priority 19.9 of 100.","summary":"Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a…","date_published":"2022-06-22T00:00:00.000Z","date_modified":"2024-08-03T08:16:17.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.9,"kev":null,"epss":{"score":0.77515,"percentile":0.9956},"cvss":null,"vendor":"Jenkins project","product":"Jenkins JUnit Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-30956","url":"https://patchfirst.co/cve/CVE-2022-30956/","title":"CVE-2022-30956: Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a…","content_text":"Jenkins project · Jenkins Rundeck Plugin. Not in CISA KEV. EPSS 73.3% (higher than 99.46% of CVEs). Priority 20.6 of 100.","summary":"Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a…","date_published":"2022-05-17T00:00:00.000Z","date_modified":"2024-08-03T07:03:39.000Z","tags":[],"_patchfirst":{"reason":"published","priority":20.6,"kev":null,"epss":{"score":0.73254,"percentile":0.99458},"cvss":null,"vendor":"Jenkins project","product":"Jenkins Rundeck Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-1003029#kev","url":"https://patchfirst.co/cve/CVE-2019-1003029/","title":"[KEV] CVE-2019-1003029: Jenkins Script Security Plugin Sandbox Bypass Vulnerability","content_text":"Jenkins · Script Security Plugin. In CISA KEV since 2022-04-25. ENISA EUVD lists it as exploited. EPSS 74.4% (higher than 99.49% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"Jenkins Script Security Plugin Sandbox Bypass Vulnerability","date_published":"2022-04-25T00:00:00.000Z","date_modified":"2026-06-17T02:09:34.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2022-04-25","ransomware":false},"epss":{"score":0.7444,"percentile":0.99492},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Jenkins","product":"Script Security Plugin","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-29036","url":"https://patchfirst.co/cve/CVE-2022-29036/","title":"CVE-2022-29036: Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4…","content_text":"Jenkins project · Jenkins Credentials Plugin. Not in CISA KEV. EPSS 71.9% (higher than 99.43% of CVEs). Priority 19.9 of 100.","summary":"Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4…","date_published":"2022-04-12T00:00:00.000Z","date_modified":"2024-08-03T06:10:58.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.9,"kev":null,"epss":{"score":0.71926,"percentile":0.99427},"cvss":null,"vendor":"Jenkins project","product":"Jenkins Credentials Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-1003030#kev","url":"https://patchfirst.co/cve/CVE-2019-1003030/","title":"[KEV] CVE-2019-1003030: Jenkins Matrix Project Plugin Remote Code Execution Vulnerability","content_text":"Jenkins · Matrix Project Plugin. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 97.1% (higher than 99.89% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.","summary":"Jenkins Matrix Project Plugin Remote Code Execution Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T02:09:34.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.97058,"percentile":0.99891},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Jenkins","product":"Matrix Project Plugin","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-1000861#kev","url":"https://patchfirst.co/cve/CVE-2018-1000861/","title":"[KEV] CVE-2018-1000861: Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability","content_text":"Jenkins · Jenkins Stapler Web Framework. In CISA KEV since 2022-02-10. ENISA EUVD lists it as exploited. EPSS 98.3% (higher than 99.92% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1190 Exploit Public-Facing Application. Priority 79.8 of 100.","summary":"Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability","date_published":"2022-02-10T00:00:00.000Z","date_modified":"2026-06-17T01:33:11.000Z","tags":["kev","public-exploit","T1059","T1190"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2022-02-10","ransomware":false},"epss":{"score":0.98326,"percentile":0.99917},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Jenkins","product":"Jenkins Stapler Web Framework","techniqueIds":["T1059","T1190"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-20615","url":"https://patchfirst.co/cve/CVE-2022-20615/","title":"CVE-2022-20615: Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label…","content_text":"Jenkins project · Jenkins Matrix Project Plugin. Not in CISA KEV. EPSS 81.8% (higher than 99.65% of CVEs). Priority 21.0 of 100.","summary":"Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label…","date_published":"2022-01-12T00:00:00.000Z","date_modified":"2024-08-03T02:17:52.000Z","tags":[],"_patchfirst":{"reason":"published","priority":21,"kev":null,"epss":{"score":0.81842,"percentile":0.99647},"cvss":null,"vendor":"Jenkins project","product":"Jenkins Matrix Project Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-21699","url":"https://patchfirst.co/cve/CVE-2021-21699/","title":"CVE-2021-21699: Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic…","content_text":"Jenkins project · Jenkins Active Choices Plugin. Not in CISA KEV. EPSS 88.5% (higher than 99.77% of CVEs). Priority 20.0 of 100.","summary":"Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic…","date_published":"2021-11-12T00:00:00.000Z","date_modified":"2024-08-03T18:23:29.000Z","tags":[],"_patchfirst":{"reason":"published","priority":20,"kev":null,"epss":{"score":0.88476,"percentile":0.9977},"cvss":null,"vendor":"Jenkins project","product":"Jenkins Active Choices Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-21668","url":"https://patchfirst.co/cve/CVE-2021-21668/","title":"CVE-2021-21668: Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting…","content_text":"Jenkins project · Jenkins Scriptler Plugin. Not in CISA KEV. EPSS 76.0% (higher than 99.53% of CVEs). Priority 19.9 of 100.","summary":"Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting…","date_published":"2021-06-16T00:00:00.000Z","date_modified":"2024-08-03T18:23:27.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.9,"kev":null,"epss":{"score":0.76016,"percentile":0.99529},"cvss":null,"vendor":"Jenkins project","product":"Jenkins Scriptler Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-21667","url":"https://patchfirst.co/cve/CVE-2021-21667/","title":"CVE-2021-21667: Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting…","content_text":"Jenkins project · Jenkins Scriptler Plugin. Not in CISA KEV. EPSS 75.7% (higher than 99.52% of CVEs). Priority 19.9 of 100.","summary":"Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting…","date_published":"2021-06-16T00:00:00.000Z","date_modified":"2024-08-03T18:23:27.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.9,"kev":null,"epss":{"score":0.75742,"percentile":0.99523},"cvss":null,"vendor":"Jenkins project","product":"Jenkins Scriptler Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-21659","url":"https://patchfirst.co/cve/CVE-2021-21659/","title":"CVE-2021-21659: Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE)…","content_text":"Jenkins project · Jenkins URLTrigger Plugin. Not in CISA KEV. EPSS 66.8% (higher than 99.29% of CVEs). Priority 19.9 of 100.","summary":"Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE)…","date_published":"2021-05-25T00:00:00.000Z","date_modified":"2024-08-03T18:23:27.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.9,"kev":null,"epss":{"score":0.66774,"percentile":0.99289},"cvss":null,"vendor":"Jenkins project","product":"Jenkins URLTrigger Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-21649","url":"https://patchfirst.co/cve/CVE-2021-21649/","title":"CVE-2021-21649: Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting…","content_text":"Jenkins project · Jenkins Dashboard View Plugin. Not in CISA KEV. EPSS 72.7% (higher than 99.44% of CVEs). Priority 19.9 of 100.","summary":"Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting…","date_published":"2021-05-11T00:00:00.000Z","date_modified":"2024-08-03T18:16:23.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.9,"kev":null,"epss":{"score":0.72678,"percentile":0.99444},"cvss":null,"vendor":"Jenkins project","product":"Jenkins Dashboard View Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-21630","url":"https://patchfirst.co/cve/CVE-2021-21630/","title":"CVE-2021-21630: Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column…","content_text":"Jenkins project · Jenkins Extra Columns Plugin. Not in CISA KEV. EPSS 72.4% (higher than 99.44% of CVEs). Priority 19.9 of 100.","summary":"Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column…","date_published":"2021-03-30T00:00:00.000Z","date_modified":"2024-08-03T18:16:23.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.9,"kev":null,"epss":{"score":0.72391,"percentile":0.99438},"cvss":null,"vendor":"Jenkins project","product":"Jenkins Extra Columns Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-21628","url":"https://patchfirst.co/cve/CVE-2021-21628/","title":"CVE-2021-21628: Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a…","content_text":"Jenkins project · Jenkins Build With Parameters Plugin. Not in CISA KEV. EPSS 81.4% (higher than 99.64% of CVEs). Priority 19.9 of 100.","summary":"Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a…","date_published":"2021-03-30T00:00:00.000Z","date_modified":"2024-08-03T18:16:23.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.9,"kev":null,"epss":{"score":0.8143,"percentile":0.99638},"cvss":null,"vendor":"Jenkins project","product":"Jenkins Build With Parameters Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-21618","url":"https://patchfirst.co/cve/CVE-2021-21618/","title":"CVE-2021-21618: Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past…","content_text":"Jenkins project · Jenkins Repository Connector Plugin. Not in CISA KEV. EPSS 79.5% (higher than 99.6% of CVEs). Priority 19.9 of 100.","summary":"Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past…","date_published":"2021-02-24T00:00:00.000Z","date_modified":"2024-08-03T18:16:23.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.9,"kev":null,"epss":{"score":0.79479,"percentile":0.99602},"cvss":null,"vendor":"Jenkins project","product":"Jenkins Repository Connector Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-21616","url":"https://patchfirst.co/cve/CVE-2021-21616/","title":"CVE-2021-21616: Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored…","content_text":"Jenkins project · Jenkins Active Choices Plugin. Not in CISA KEV. EPSS 76.2% (higher than 99.53% of CVEs). Priority 19.9 of 100.","summary":"Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored…","date_published":"2021-02-24T00:00:00.000Z","date_modified":"2024-08-03T18:16:23.000Z","tags":[],"_patchfirst":{"reason":"published","priority":19.9,"kev":null,"epss":{"score":0.76218,"percentile":0.99535},"cvss":null,"vendor":"Jenkins project","product":"Jenkins Active Choices Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-2230","url":"https://patchfirst.co/cve/CVE-2020-2230/","title":"CVE-2020-2230: Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting…","content_text":"Jenkins project · Jenkins. Not in CISA KEV. EPSS 82.7% (higher than 99.67% of CVEs). Public exploit code exists. Priority 24.9 of 100.","summary":"Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting…","date_published":"2020-08-12T00:00:00.000Z","date_modified":"2024-08-04T07:01:41.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":24.9,"kev":null,"epss":{"score":0.82733,"percentile":0.99668},"cvss":null,"vendor":"Jenkins project","product":"Jenkins","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2020-2140","url":"https://patchfirst.co/cve/CVE-2020-2140/","title":"CVE-2020-2140: Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form…","content_text":"Jenkins project · Jenkins Audit Trail Plugin. Not in CISA KEV. EPSS 76.0% (higher than 99.53% of CVEs). Public exploit code exists. Priority 24.9 of 100.","summary":"Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form…","date_published":"2020-03-09T00:00:00.000Z","date_modified":"2024-08-04T07:01:41.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":24.9,"kev":null,"epss":{"score":0.75975,"percentile":0.99528},"cvss":null,"vendor":"Jenkins project","product":"Jenkins Audit Trail Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2020-2096","url":"https://patchfirst.co/cve/CVE-2020-2096/","title":"CVE-2020-2096: Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a…","content_text":"Jenkins project · Jenkins Gitlab Hook Plugin. Not in CISA KEV. EPSS 93.2% (higher than 99.83% of CVEs). Public exploit code exists. Priority 60.0 of 100.","summary":"Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a…","date_published":"2020-01-15T00:00:00.000Z","date_modified":"2024-08-04T06:54:00.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":60,"kev":null,"epss":{"score":0.93206,"percentile":0.99834},"cvss":null,"vendor":"Jenkins project","product":"Jenkins Gitlab Hook Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2019-10475","url":"https://patchfirst.co/cve/CVE-2019-10475/","title":"CVE-2019-10475: A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary…","content_text":"Jenkins project · Jenkins build-metrics Plugin. Not in CISA KEV. EPSS 57.7% (higher than 99.08% of CVEs). Public exploit code exists. Priority 24.8 of 100.","summary":"A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary…","date_published":"2019-10-23T00:00:00.000Z","date_modified":"2024-08-04T22:24:18.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":24.8,"kev":null,"epss":{"score":0.57735,"percentile":0.99083},"cvss":null,"vendor":"Jenkins project","product":"Jenkins build-metrics Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2019-10405","url":"https://patchfirst.co/cve/CVE-2019-10405/","title":"CVE-2019-10405: Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the \"Cookie\" HTTP request header on the…","content_text":"Jenkins project · Jenkins. Not in CISA KEV. EPSS 65.3% (higher than 99.25% of CVEs). Public exploit code exists. Priority 24.9 of 100.","summary":"Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the \"Cookie\" HTTP request header on the…","date_published":"2019-09-25T00:00:00.000Z","date_modified":"2024-08-04T22:24:16.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":24.9,"kev":null,"epss":{"score":0.6529,"percentile":0.99254},"cvss":null,"vendor":"Jenkins project","product":"Jenkins","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2019-1003000","url":"https://patchfirst.co/cve/CVE-2019-1003000/","title":"CVE-2019-1003000: A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in…","content_text":"Jenkins project · Script Security Plugin. Not in CISA KEV. EPSS 98.4% (higher than 99.92% of CVEs). Public exploit code exists. Priority 62.1 of 100.","summary":"A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in…","date_published":"2019-01-22T00:00:00.000Z","date_modified":"2024-08-05T03:00:19.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":62.1,"kev":null,"epss":{"score":0.98375,"percentile":0.99918},"cvss":null,"vendor":"Jenkins project","product":"Script Security Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2019-1003001","url":"https://patchfirst.co/cve/CVE-2019-1003001/","title":"CVE-2019-1003001: A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in…","content_text":"Jenkins project · Pipeline: Groovy Plugin. Not in CISA KEV. EPSS 86.1% (higher than 99.73% of CVEs). Public exploit code exists. Priority 61.5 of 100.","summary":"A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in…","date_published":"2019-01-22T00:00:00.000Z","date_modified":"2024-08-05T03:00:19.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":61.5,"kev":null,"epss":{"score":0.86054,"percentile":0.99729},"cvss":null,"vendor":"Jenkins project","product":"Pipeline: Groovy Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2019-1003002","url":"https://patchfirst.co/cve/CVE-2019-1003002/","title":"CVE-2019-1003002: A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in…","content_text":"Jenkins project · Pipeline: Declarative Plugin. Not in CISA KEV. EPSS 81.4% (higher than 99.64% of CVEs). Public exploit code exists. Priority 24.9 of 100.","summary":"A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in…","date_published":"2019-01-22T00:00:00.000Z","date_modified":"2024-08-05T03:00:19.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":24.9,"kev":null,"epss":{"score":0.81362,"percentile":0.99637},"cvss":null,"vendor":"Jenkins project","product":"Pipeline: Declarative Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}}]}