Patchfirst: Jenkins vulnerabilitieshttps://patchfirst.co/vendor/jenkins/New and newly exploited Jenkins CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMTCVE-2026-53435: In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize…https://patchfirst.co/cve/CVE-2026-53435/CVE-2026-53435Wed, 10 Jun 2026 00:00:00 GMTJenkins Project · Jenkins. Not in CISA KEV. EPSS 53.1% (higher than 99% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. Priority 73.2 of 100.public-exploit[KEV] CVE-2017-1000353: Jenkins Remote Code Execution Vulnerabilityhttps://patchfirst.co/cve/CVE-2017-1000353/CVE-2017-1000353#kevThu, 02 Oct 2025 00:00:00 GMTJenkins · Jenkins. In CISA KEV since 2025-10-02. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.kevpublic-exploitT1190T1059CVE-2025-59474: Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page…https://patchfirst.co/cve/CVE-2025-59474/CVE-2025-59474Wed, 17 Sep 2025 00:00:00 GMTJenkins Project · Jenkins. Not in CISA KEV. EPSS 5.0% (higher than 92.2% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. Priority 63.2 of 100.public-exploitCVE-2024-54003: Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site…https://patchfirst.co/cve/CVE-2024-54003/CVE-2024-54003Wed, 27 Nov 2024 00:00:00 GMTJenkins Project · Jenkins Simple Queue Plugin. Not in CISA KEV. EPSS 80.1% (higher than 99.61% of CVEs). CVSS 8.0 HIGH. Priority 25.5 of 100.[KEV] CVE-2024-23897: Jenkins Command Line Interface (CLI) Path Traversal Vulnerabilityhttps://patchfirst.co/cve/CVE-2024-23897/CVE-2024-23897#kevMon, 19 Aug 2024 00:00:00 GMTJenkins · Jenkins Command Line Interface (CLI). In CISA KEV since 2024-08-19, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 79.9 of 100.kevransomwarepublic-exploitT1190T1005CVE-2024-28156: Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names…https://patchfirst.co/cve/CVE-2024-28156/CVE-2024-28156Wed, 06 Mar 2024 00:00:00 GMTJenkins Project · Jenkins Build Monitor View Plugin. Not in CISA KEV. EPSS 79.3% (higher than 99.6% of CVEs). CVSS 5.4 MEDIUM. Priority 23.7 of 100.CVE-2024-23898: Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin…https://patchfirst.co/cve/CVE-2024-23898/CVE-2024-23898Wed, 24 Jan 2024 00:00:00 GMTJenkins Project · Jenkins. Not in CISA KEV. EPSS 67.2% (higher than 99.3% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. Priority 31.7 of 100.public-exploitCVE-2023-32986: Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file…https://patchfirst.co/cve/CVE-2023-32986/CVE-2023-32986Tue, 16 May 2023 00:00:00 GMTJenkins Project · Jenkins File Parameter Plugin. Not in CISA KEV. EPSS 60.7% (higher than 99.15% of CVEs). CVSS 8.8 HIGH. Priority 26.0 of 100.CVE-2023-32985: Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form…https://patchfirst.co/cve/CVE-2023-32985/CVE-2023-32985Tue, 16 May 2023 00:00:00 GMTJenkins Project · Jenkins Sidebar Link Plugin. Not in CISA KEV. EPSS 72.4% (higher than 99.44% of CVEs). CVSS 4.3 MEDIUM. Priority 22.9 of 100.[KEV] CVE-2015-5317: Jenkins User Interface (UI) Information Disclosure Vulnerabilityhttps://patchfirst.co/cve/CVE-2015-5317/CVE-2015-5317#kevFri, 12 May 2023 00:00:00 GMTJenkins · Jenkins User Interface (UI). In CISA KEV since 2023-05-12. ENISA EUVD lists it as exploited. EPSS 23.0% (higher than 97.7% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1592 Gather Victim Host Information. Priority 62.8 of 100.kevT1190T1592CVE-2023-25762: Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the…https://patchfirst.co/cve/CVE-2023-25762/CVE-2023-25762Wed, 15 Feb 2023 00:00:00 GMTJenkins Project · Jenkins Pipeline: Build Step Plugin. Not in CISA KEV. EPSS 82.1% (higher than 99.65% of CVEs). CVSS 5.4 MEDIUM. Priority 23.7 of 100.CVE-2022-36883: A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds…https://patchfirst.co/cve/CVE-2022-36883/CVE-2022-36883Wed, 27 Jul 2022 00:00:00 GMTJenkins project · Jenkins Git Plugin. Not in CISA KEV. EPSS 7.0% (higher than 94.2% of CVEs). Public exploit code exists. Priority 63.8 of 100.public-exploitCVE-2022-34783: Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting…https://patchfirst.co/cve/CVE-2022-34783/CVE-2022-34783Thu, 30 Jun 2022 00:00:00 GMTJenkins project · Jenkins Plot Plugin. Not in CISA KEV. EPSS 81.8% (higher than 99.64% of CVEs). Priority 19.9 of 100.CVE-2022-34777: Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of…https://patchfirst.co/cve/CVE-2022-34777/CVE-2022-34777Thu, 30 Jun 2022 00:00:00 GMTJenkins project · Jenkins GitLab Plugin. Not in CISA KEV. EPSS 73.6% (higher than 99.47% of CVEs). Priority 19.9 of 100.CVE-2022-34176: Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a…https://patchfirst.co/cve/CVE-2022-34176/CVE-2022-34176Wed, 22 Jun 2022 00:00:00 GMTJenkins project · Jenkins JUnit Plugin. Not in CISA KEV. EPSS 77.5% (higher than 99.56% of CVEs). Priority 19.9 of 100.CVE-2022-30956: Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a…https://patchfirst.co/cve/CVE-2022-30956/CVE-2022-30956Tue, 17 May 2022 00:00:00 GMTJenkins project · Jenkins Rundeck Plugin. Not in CISA KEV. EPSS 73.3% (higher than 99.46% of CVEs). Priority 20.6 of 100.[KEV] CVE-2019-1003029: Jenkins Script Security Plugin Sandbox Bypass Vulnerabilityhttps://patchfirst.co/cve/CVE-2019-1003029/CVE-2019-1003029#kevMon, 25 Apr 2022 00:00:00 GMTJenkins · Script Security Plugin. In CISA KEV since 2022-04-25. ENISA EUVD lists it as exploited. EPSS 74.4% (higher than 99.49% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.kevpublic-exploitT1190T1059CVE-2022-29036: Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4…https://patchfirst.co/cve/CVE-2022-29036/CVE-2022-29036Tue, 12 Apr 2022 00:00:00 GMTJenkins project · Jenkins Credentials Plugin. Not in CISA KEV. EPSS 71.9% (higher than 99.43% of CVEs). Priority 19.9 of 100.[KEV] CVE-2019-1003030: Jenkins Matrix Project Plugin Remote Code Execution Vulnerabilityhttps://patchfirst.co/cve/CVE-2019-1003030/CVE-2019-1003030#kevFri, 25 Mar 2022 00:00:00 GMTJenkins · Matrix Project Plugin. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 97.1% (higher than 99.89% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.kevpublic-exploitT1190T1059[KEV] CVE-2018-1000861: Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerabilityhttps://patchfirst.co/cve/CVE-2018-1000861/CVE-2018-1000861#kevThu, 10 Feb 2022 00:00:00 GMTJenkins · Jenkins Stapler Web Framework. In CISA KEV since 2022-02-10. ENISA EUVD lists it as exploited. EPSS 98.3% (higher than 99.92% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1190 Exploit Public-Facing Application. Priority 79.8 of 100.kevpublic-exploitT1059T1190CVE-2022-20615: Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label…https://patchfirst.co/cve/CVE-2022-20615/CVE-2022-20615Wed, 12 Jan 2022 00:00:00 GMTJenkins project · Jenkins Matrix Project Plugin. Not in CISA KEV. EPSS 81.8% (higher than 99.65% of CVEs). Priority 21.0 of 100.CVE-2021-21699: Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic…https://patchfirst.co/cve/CVE-2021-21699/CVE-2021-21699Fri, 12 Nov 2021 00:00:00 GMTJenkins project · Jenkins Active Choices Plugin. Not in CISA KEV. EPSS 88.5% (higher than 99.77% of CVEs). Priority 20.0 of 100.CVE-2021-21668: Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting…https://patchfirst.co/cve/CVE-2021-21668/CVE-2021-21668Wed, 16 Jun 2021 00:00:00 GMTJenkins project · Jenkins Scriptler Plugin. Not in CISA KEV. EPSS 76.0% (higher than 99.53% of CVEs). Priority 19.9 of 100.CVE-2021-21667: Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting…https://patchfirst.co/cve/CVE-2021-21667/CVE-2021-21667Wed, 16 Jun 2021 00:00:00 GMTJenkins project · Jenkins Scriptler Plugin. Not in CISA KEV. EPSS 75.7% (higher than 99.52% of CVEs). Priority 19.9 of 100.CVE-2021-21659: Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE)…https://patchfirst.co/cve/CVE-2021-21659/CVE-2021-21659Tue, 25 May 2021 00:00:00 GMTJenkins project · Jenkins URLTrigger Plugin. Not in CISA KEV. EPSS 66.8% (higher than 99.29% of CVEs). Priority 19.9 of 100.CVE-2021-21649: Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting…https://patchfirst.co/cve/CVE-2021-21649/CVE-2021-21649Tue, 11 May 2021 00:00:00 GMTJenkins project · Jenkins Dashboard View Plugin. Not in CISA KEV. EPSS 72.7% (higher than 99.44% of CVEs). Priority 19.9 of 100.CVE-2021-21630: Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column…https://patchfirst.co/cve/CVE-2021-21630/CVE-2021-21630Tue, 30 Mar 2021 00:00:00 GMTJenkins project · Jenkins Extra Columns Plugin. Not in CISA KEV. EPSS 72.4% (higher than 99.44% of CVEs). Priority 19.9 of 100.CVE-2021-21628: Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a…https://patchfirst.co/cve/CVE-2021-21628/CVE-2021-21628Tue, 30 Mar 2021 00:00:00 GMTJenkins project · Jenkins Build With Parameters Plugin. Not in CISA KEV. EPSS 81.4% (higher than 99.64% of CVEs). Priority 19.9 of 100.CVE-2021-21618: Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past…https://patchfirst.co/cve/CVE-2021-21618/CVE-2021-21618Wed, 24 Feb 2021 00:00:00 GMTJenkins project · Jenkins Repository Connector Plugin. Not in CISA KEV. EPSS 79.5% (higher than 99.6% of CVEs). Priority 19.9 of 100.CVE-2021-21616: Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored…https://patchfirst.co/cve/CVE-2021-21616/CVE-2021-21616Wed, 24 Feb 2021 00:00:00 GMTJenkins project · Jenkins Active Choices Plugin. Not in CISA KEV. EPSS 76.2% (higher than 99.53% of CVEs). Priority 19.9 of 100.CVE-2020-2230: Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting…https://patchfirst.co/cve/CVE-2020-2230/CVE-2020-2230Wed, 12 Aug 2020 00:00:00 GMTJenkins project · Jenkins. Not in CISA KEV. EPSS 82.7% (higher than 99.67% of CVEs). Public exploit code exists. Priority 24.9 of 100.public-exploitCVE-2020-2140: Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form…https://patchfirst.co/cve/CVE-2020-2140/CVE-2020-2140Mon, 09 Mar 2020 00:00:00 GMTJenkins project · Jenkins Audit Trail Plugin. Not in CISA KEV. EPSS 76.0% (higher than 99.53% of CVEs). Public exploit code exists. Priority 24.9 of 100.public-exploitCVE-2020-2096: Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a…https://patchfirst.co/cve/CVE-2020-2096/CVE-2020-2096Wed, 15 Jan 2020 00:00:00 GMTJenkins project · Jenkins Gitlab Hook Plugin. Not in CISA KEV. EPSS 93.2% (higher than 99.83% of CVEs). Public exploit code exists. Priority 60.0 of 100.public-exploitCVE-2019-10475: A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary…https://patchfirst.co/cve/CVE-2019-10475/CVE-2019-10475Wed, 23 Oct 2019 00:00:00 GMTJenkins project · Jenkins build-metrics Plugin. Not in CISA KEV. EPSS 57.7% (higher than 99.08% of CVEs). Public exploit code exists. Priority 24.8 of 100.public-exploitCVE-2019-10405: Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the…https://patchfirst.co/cve/CVE-2019-10405/CVE-2019-10405Wed, 25 Sep 2019 00:00:00 GMTJenkins project · Jenkins. Not in CISA KEV. EPSS 65.3% (higher than 99.25% of CVEs). Public exploit code exists. Priority 24.9 of 100.public-exploitCVE-2019-1003000: A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in…https://patchfirst.co/cve/CVE-2019-1003000/CVE-2019-1003000Tue, 22 Jan 2019 00:00:00 GMTJenkins project · Script Security Plugin. Not in CISA KEV. EPSS 98.4% (higher than 99.92% of CVEs). Public exploit code exists. Priority 62.1 of 100.public-exploitCVE-2019-1003001: A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in…https://patchfirst.co/cve/CVE-2019-1003001/CVE-2019-1003001Tue, 22 Jan 2019 00:00:00 GMTJenkins project · Pipeline: Groovy Plugin. Not in CISA KEV. EPSS 86.1% (higher than 99.73% of CVEs). Public exploit code exists. Priority 61.5 of 100.public-exploitCVE-2019-1003002: A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in…https://patchfirst.co/cve/CVE-2019-1003002/CVE-2019-1003002Tue, 22 Jan 2019 00:00:00 GMTJenkins project · Pipeline: Declarative Plugin. Not in CISA KEV. EPSS 81.4% (higher than 99.64% of CVEs). Public exploit code exists. Priority 24.9 of 100.public-exploit