Patchfirst
Patchfirst

Vendor

Jenkins

6 of 38 Jenkins CVEs in Patchfirst (16%) are in of vulnerabilities exploited in the wild, 1 of them used by ransomware.

CVEs
38
In CISA KEV
616%
Known ransomware use
1
Median days to KEV
1,151
from publication
Latest KEV listing
2 Oct 2025
Watch Jenkins Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs
  • Jenkins In KEV: 1 CVEs: 6
  • Script Security Plugin In KEV: 1 CVEs: 2
  • Jenkins Command Line Interface (CLI) In KEV: 1 CVEs: 1
  • Jenkins Stapler Web Framework In KEV: 1 CVEs: 1
  • Jenkins User Interface (UI) In KEV: 1 CVEs: 1
  • Matrix Project Plugin In KEV: 1 CVEs: 1
  • Jenkins Active Choices Plugin In KEV: 0 CVEs: 2
  • Jenkins Scriptler Plugin In KEV: 0 CVEs: 2
  • Jenkins Audit Trail Plugin In KEV: 0 CVEs: 1
  • Jenkins Build Monitor View Plugin In KEV: 0 CVEs: 1

Top ATT&CK techniques

What attackers do with Jenkins CVEs
Open in ATT&CK Navigator

Counts are Jenkins CVEs linked to the technique. Each link’s provenance is on the CVE page.

Jenkins CVEs

38 CVEs, by priority
  1. CVE-2024-23897Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
    Jenkins · Jenkins Command Line Interface (CLI)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1005Data from Local System
    >99.9%Top 0.01%
    79.9priority
  2. CVE-2018-1000861Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
    Jenkins · Jenkins Stapler Web FrameworkKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    98.3%Top 0.08%
    79.8priority
  3. CVE-2026-53435In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize…
    Jenkins Project · JenkinsPublic exploitHigh · 8.8
    53.1%Top 1%
    73.2priority
  4. CVE-2019-1003030Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
    Jenkins · Matrix Project PluginKEVPublic exploitCritical · 9.9T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    97.1%Top 0.11%
    69.9priority
  5. CVE-2017-1000353Jenkins Remote Code Execution Vulnerability
    Jenkins · JenkinsKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    99.7%Top 0.05%
    69.9priority
  6. CVE-2019-1003029Jenkins Script Security Plugin Sandbox Bypass Vulnerability
    Jenkins · Script Security PluginKEVPublic exploitCritical · 9.9T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    74.4%Top 0.51%
    69.8priority
  7. CVE-2022-36883A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds…
    Jenkins project · Jenkins Git PluginPublic exploit
    7.0%Top 5.8%
    63.8priority
  8. CVE-2025-59474Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page…
    Jenkins Project · JenkinsPublic exploitMedium · 5.3
    5.0%Top 7.8%
    63.2priority
  9. CVE-2015-5317Jenkins User Interface (UI) Information Disclosure Vulnerability
    Jenkins · Jenkins User Interface (UI)KEVHigh · 7.5T1592Gather Victim Host InformationT1190Exploit Public-Facing Application
    23.0%Top 2.3%
    62.8priority
  10. CVE-2019-1003000A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in…
    Jenkins project · Script Security PluginPublic exploit
    98.4%Top 0.08%
    62.1priority
  11. CVE-2019-1003001A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in…
    Jenkins project · Pipeline: Groovy PluginPublic exploit
    86.1%Top 0.27%
    61.5priority
  12. CVE-2020-2096Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a…
    Jenkins project · Jenkins Gitlab Hook PluginPublic exploit
    93.2%Top 0.17%
    60.0priority
  13. CVE-2024-23898Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin…
    Jenkins Project · JenkinsPublic exploitHigh · 8.8
    67.2%Top 0.7%
    31.7priority
  14. CVE-2023-32986Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file…
    Jenkins Project · Jenkins File Parameter PluginHigh · 8.8
    60.7%Top 0.85%
    26.0priority
  15. CVE-2024-54003Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site…
    Jenkins Project · Jenkins Simple Queue PluginHigh · 8.0
    80.1%Top 0.39%
    25.5priority
  16. CVE-2020-2230Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting…
    Jenkins project · JenkinsPublic exploit
    82.7%Top 0.33%
    24.9priority
  17. CVE-2020-2140Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form…
    Jenkins project · Jenkins Audit Trail PluginPublic exploit
    76.0%Top 0.47%
    24.9priority
  18. CVE-2019-10405Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the…
    Jenkins project · JenkinsPublic exploit
    65.3%Top 0.75%
    24.9priority
  19. CVE-2019-1003002A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in…
    Jenkins project · Pipeline: Declarative PluginPublic exploit
    81.4%Top 0.36%
    24.9priority
  20. CVE-2019-10475A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary…
    Jenkins project · Jenkins build-metrics PluginPublic exploit
    57.7%Top 0.92%
    24.8priority
  21. CVE-2024-28156Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names…
    Jenkins Project · Jenkins Build Monitor View PluginMedium · 5.4
    79.3%Top 0.4%
    23.7priority
  22. CVE-2023-25762Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the…
    Jenkins Project · Jenkins Pipeline: Build Step PluginMedium · 5.4
    82.1%Top 0.35%
    23.7priority
  23. CVE-2023-32985Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form…
    Jenkins Project · Jenkins Sidebar Link PluginMedium · 4.3
    72.4%Top 0.56%
    22.9priority
  24. CVE-2022-20615Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label…
    Jenkins project · Jenkins Matrix Project Plugin
    81.8%Top 0.35%
    21.0priority
  25. CVE-2022-30956Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a…
    Jenkins project · Jenkins Rundeck Plugin
    73.3%Top 0.54%
    20.6priority
  26. CVE-2021-21699Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic…
    Jenkins project · Jenkins Active Choices Plugin
    88.5%Top 0.23%
    20.0priority
  27. CVE-2022-34783Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting…
    Jenkins project · Jenkins Plot Plugin
    81.8%Top 0.36%
    19.9priority
  28. CVE-2022-34777Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of…
    Jenkins project · Jenkins GitLab Plugin
    73.6%Top 0.53%
    19.9priority
  29. CVE-2022-34176Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a…
    Jenkins project · Jenkins JUnit Plugin
    77.5%Top 0.44%
    19.9priority
  30. CVE-2022-29036Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4…
    Jenkins project · Jenkins Credentials Plugin
    71.9%Top 0.57%
    19.9priority
  31. CVE-2021-21668Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting…
    Jenkins project · Jenkins Scriptler Plugin
    76.0%Top 0.47%
    19.9priority
  32. CVE-2021-21667Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting…
    Jenkins project · Jenkins Scriptler Plugin
    75.7%Top 0.48%
    19.9priority
  33. CVE-2021-21659Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE)…
    Jenkins project · Jenkins URLTrigger Plugin
    66.8%Top 0.71%
    19.9priority
  34. CVE-2021-21649Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting…
    Jenkins project · Jenkins Dashboard View Plugin
    72.7%Top 0.56%
    19.9priority
  35. CVE-2021-21630Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column…
    Jenkins project · Jenkins Extra Columns Plugin
    72.4%Top 0.56%
    19.9priority
  36. CVE-2021-21628Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a…
    Jenkins project · Jenkins Build With Parameters Plugin
    81.4%Top 0.36%
    19.9priority
  37. CVE-2021-21618Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past…
    Jenkins project · Jenkins Repository Connector Plugin
    79.5%Top 0.4%
    19.9priority
  38. CVE-2021-21616Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored…
    Jenkins project · Jenkins Active Choices Plugin
    76.2%Top 0.47%
    19.9priority
↑ ↓ chooseEnter openEsc close