Veille CVE

Recherche « Jenkins Project Jenkins »

127 CVE

Critique 1 Élevée 39 Moyenne 82 Faible 5 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Jenkins Project Jenkins » ✕
  1. CVE-2026-107597 5.1 Moyenne

    Eclipse Foundation Eclipse CSI - PIA

    PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the field is non-empty (`pia/oidc.py:42-52`). An approved identity provider — and every registered per-project Jenkins instance under `https://ci.eclipse.org/<project>/oidc` is a separate such party (`pia/models.py`) — can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext `http`, from PIA's own network position. The fetch happens before any signature is verified, as a side effect of an unauthenticated `POST /v1/upload/sbom` request that is ultimately rejected with 401.

  2. CVE-2026-92141 4.3 Moyenne

    Jenkins Project Jenkins Keycloak Authentication Plugin

    Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

  3. CVE-2026-92140 6.8 Moyenne

    Jenkins Project Jenkins Gitee Plugin

    Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint.

  4. CVE-2026-92139 6.5 Moyenne

    Jenkins Project Jenkins Bitbucket Push and Pull Request Plugin

    Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.

  5. CVE-2026-92138 4.2 Moyenne

    Jenkins Project Jenkins Bitbucket Server Integration Plugin

    The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the victim.

  6. CVE-2026-92137 8.8 Élevée

    Jenkins Project Jenkins Robot Framework Plugin

    Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content, which can lead to remote code execution.

  7. CVE-2026-92136 8.0 Élevée

    Jenkins Project Jenkins OWASP Dependency-Check Plugin

    Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

  8. CVE-2026-92135 8.0 Élevée

    Jenkins Project Jenkins Coverage Plugin

    Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.

  9. CVE-2026-92134 8.0 Élevée

    Jenkins Project Jenkins Warnings Plugin

    Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.

  10. CVE-2026-92133 5.4 Moyenne

    Jenkins Project Jenkins GitLab Plugin

    Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure permission to access GitLab API token credentials they are not entitled to use.

  11. CVE-2026-92132 5.4 Moyenne

    Jenkins Project Jenkins Gradle Plugin

    Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key configured in the global configuration by having Jenkins connect to an attacker-specified URL.

  12. CVE-2026-92131 4.2 Moyenne

    Jenkins Project Jenkins Pipeline: Groovy Libraries Plugin

    Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to locations outside of the SCM checkout when retrieving the library, resulting in a path traversal vulnerability, allowing attackers able to configure Pipelines to read files in a resources directory and to delete files in a test directory on the Jenkins controller file system.

  13. CVE-2026-92130 3.1 Faible

    Jenkins Project Jenkins Pipeline: Multibranch Plugin

    Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.

  14. CVE-2026-92129 7.5 Élevée

    Jenkins Project Jenkins Script Security Plugin · Jenkins script security

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute code outside the sandbox.

  15. CVE-2026-92128 7.5 Élevée

    Jenkins Project Jenkins Script Security Plugin · Jenkins script security

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM.

  16. CVE-2026-92127 8.0 Élevée

    Jenkins Project Jenkins Script Security Plugin · Jenkins script security

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM.

  17. CVE-2026-92126 8.5 Élevée

    Jenkins Project Jenkins Script Security Plugin · Jenkins script security

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable class is present on the classpath of the component that evaluates the script.

  18. CVE-2026-92125 8.8 Élevée

    Jenkins Project Jenkins Script Security Plugin · Jenkins script security

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox protection and executing arbitrary code in the context of the Jenkins controller JVM.

  19. CVE-2026-92124 8.8 Élevée

    Jenkins Project Jenkins Script Security Plugin · Jenkins script security

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast on the collection itself, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

  20. CVE-2026-92123 8.8 Élevée

    Jenkins Project Jenkins Script Security Plugin · Jenkins script security

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribute accesses, and array accesses), allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

  21. CVE-2026-92122 8.8 Élevée

    Jenkins Project Jenkins Script Security Plugin · Jenkins script security

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

  22. CVE-2026-84677 5.4 Moyenne

    Jenkins Project Jenkins update-center2

    Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.

  23. CVE-2026-84676 4.3 Moyenne

    Jenkins Project Jenkins Parameterized Remote Trigger Plugin

    Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

  24. CVE-2026-84675 7.4 Élevée

    Jenkins Project Jenkins TICS Plugin

    OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build.

  25. CVE-2026-84674 5.4 Moyenne

    Jenkins Project Jenkins XebiaLabs XL Deploy Plugin

    Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

  26. CVE-2026-84673 8.8 Élevée

    Jenkins Project Jenkins Customizable Header Plugin

    Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability.

  27. CVE-2026-84672 8.8 Élevée

    Jenkins Project Jenkins Microsoft Entra ID (previously Azure AD) Plugin

    Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a privileged group.

  28. CVE-2026-84671 8.8 Élevée

    Jenkins Project Jenkins File Parameter Plugin

    Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution.

  29. CVE-2026-84670 8.8 Élevée

    Jenkins Project Jenkins Performance Plugin

    Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

  30. CVE-2026-84669 8.8 Élevée

    Jenkins Project Jenkins Allure Plugin

    A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system.

  31. CVE-2026-84668 8.8 Élevée

    Jenkins Project Jenkins SAML Plugin

    Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user.

  32. CVE-2026-84667 7.1 Élevée

    Jenkins Project Jenkins ThinBackup Plugin

    Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups.

  33. CVE-2026-84666 5.4 Moyenne

    Jenkins Project Jenkins Job Configuration History Plugin

    Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings.

  34. CVE-2026-84665 8.0 Élevée

    Jenkins Project Jenkins SonarQube Scanner Plugin

    Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

  35. CVE-2026-84664 5.4 Moyenne

    Jenkins Project Jenkins GitLab Plugin

    Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators.

  36. CVE-2026-84663 5.4 Moyenne

    Jenkins Project Jenkins Pipeline: Groovy Libraries Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches.

  37. CVE-2026-84662 4.3 Moyenne

    Jenkins Project Jenkins LDAP Plugin

    Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an attacker-specified URL.

  38. CVE-2026-84661 5.4 Moyenne

    Jenkins Project Jenkins Pipeline: Build Step Plugin

    A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `waitForBuild` step when the `propagateAbort` parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.

  39. CVE-2026-84660 5.4 Moyenne

    Jenkins Project Jenkins Pipeline: Build Step Plugin

    A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.

  40. CVE-2026-84659 4.3 Moyenne

    Jenkins Project Jenkins Script Security Plugin · Jenkins script security

    Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.

  41. CVE-2026-84658 4.3 Moyenne

    Jenkins Project Jenkins Script Security Plugin · Jenkins script security

    Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration.

  42. CVE-2026-84657 4.2 Moyenne

    Jenkins Project Jenkins · Jenkins jenkins

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users.

  43. CVE-2026-84656 4.3 Moyenne

    Jenkins Project Jenkins · Jenkins jenkins

    A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to.

  44. CVE-2026-84655 4.3 Moyenne

    Jenkins Project Jenkins · Jenkins jenkins

    Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses.

  45. CVE-2026-84654 5.4 Moyenne

    Jenkins Project Jenkins

    In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify public static fields of the configuration objects those forms are bound to, resulting in changes that apply globally to the Jenkins instance.

  46. CVE-2026-84653 3.5 Faible

    Jenkins Project Jenkins · Jenkins jenkins

    Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to.

  47. CVE-2026-84652 7.3 Élevée

    Jenkins Project Jenkins · Jenkins jenkins

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacker access to Jenkins as that user.

  48. CVE-2026-84651 6.3 Moyenne

    Jenkins Project Jenkins · Jenkins jenkins

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure permission on one agent to take over a different agent, gaining control of its configuration and obtaining access to its inbound agent secret and environment variables.

  49. CVE-2026-84650 8.8 Élevée

    Jenkins Project Jenkins · Jenkins jenkins

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.

  50. CVE-2026-84649 8.8 Élevée

    Jenkins Project Jenkins

    In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's cross-site request forgery (CSRF) token (crumb) as a string literal, allowing attackers with control over a page hosted on the same site as Jenkins to obtain a valid crumb for the targeted user's session and perform actions on their behalf.

  51. CVE-2026-84648 8.8 Élevée

    Jenkins Project Jenkins · Jenkins jenkins

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

  52. CVE-2026-84647 8.8 Élevée

    Jenkins Project Jenkins

    In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing attackers with Overall/Read permission to instantiate types related to configuration for which that field type was not intended.

  53. CVE-2026-84646 4.3 Moyenne

    Jenkins Project Jenkins · Jenkins jenkins

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.

  54. CVE-2026-84645 8.8 Élevée

    Jenkins Project Jenkins · Jenkins jenkins

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the global configuration and jobs) can appear as nested field values in user-submitted `config.xml` documents and subsequently handle HTTP requests via Stapler, resulting in remote code execution.

  55. CVE-2026-70448 7.1 Élevée

    Jenkins Project Jenkins Ivy Report Plugin

    Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing Ivy report files.

  56. CVE-2026-70447 4.3 Moyenne

    Jenkins Project Jenkins AWS CodeBuild Plugin

    Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

  57. CVE-2026-70446 4.3 Moyenne

    Jenkins Project Jenkins CodeSonar Plugin

    Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

  58. CVE-2026-70445 4.3 Moyenne

    Jenkins Project Jenkins Sauce OnDemand Plugin

    Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

  59. CVE-2026-70444 4.3 Moyenne

    Jenkins Project Jenkins Violation Comments to GitLab Plugin

    A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

  60. CVE-2026-70443 4.3 Moyenne

    Jenkins Project Jenkins Horreum Plugin

    Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL.

  61. CVE-2026-70442 4.3 Moyenne

    Jenkins Project Jenkins Google Chat Notification Plugin

    Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to use.

  62. CVE-2026-70441 5.4 Moyenne

    Jenkins Project Jenkins Summary Display Plugin

    Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Create or Item/Configure permission.

  63. CVE-2026-70440 5.4 Moyenne

    Jenkins Project Jenkins Qualys Container Scanning Connector Plugin

    Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

  64. CVE-2026-70439 6.5 Moyenne

    Jenkins Project Jenkins XML Job to Job DSL Plugin

    Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality.

  65. CVE-2026-70438 4.3 Moyenne

    Jenkins Project Jenkins Parameterized Remote Trigger Plugin

    A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

  66. CVE-2026-70437 3.7 Faible

    Jenkins Project Jenkins Webhook Secret Credentials Provider Plugin

    Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bearer token.

  67. CVE-2026-70436 4.3 Moyenne

    Jenkins Project Jenkins External Workspace Manager Plugin

    Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper permission check (1.4.1) when providing access to externally-managed workspaces through the workspace browser, allowing attackers with Overall/Read permission to read files in workspaces they are not authorized to access.

  68. CVE-2026-70435 4.2 Moyenne

    Jenkins Project Jenkins SCM-Manager Plugin

    A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

  69. CVE-2026-70434 4.2 Moyenne

    Jenkins Project Jenkins SCM-Manager Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

  70. CVE-2026-70433 4.3 Moyenne

    Jenkins Project Jenkins HCL AppScan Plugin

    Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

  71. CVE-2026-70432 8.8 Élevée

    Jenkins Project Jenkins Multijob Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM.

  72. CVE-2026-70431 8.8 Élevée

    Jenkins Project Jenkins Multijob Plugin

    Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

  73. CVE-2026-70430 2.7 Faible

    Jenkins Project Jenkins · Jenkins jenkins

    Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those intended for configuration only by administrators.

  74. CVE-2026-70429 6.5 Moyenne

    Jenkins Project Jenkins · Jenkins jenkins

    Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in some circumstances.

  75. CVE-2026-70428 4.3 Moyenne

    Jenkins Project Jenkins · Jenkins jenkins

    Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.

  76. CVE-2026-70427 4.3 Moyenne

    Jenkins Project Jenkins · Jenkins jenkins

    Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins.

  77. CVE-2026-70426 9.0 Critique

    Jenkins Project Jenkins · Jenkins Project Remoting

    In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.

  78. CVE-2026-57307 4.2 Moyenne

    Jenkins Project Jenkins Zowe zDevOps Plugin · Jenkins zowe zdevops

    A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

  79. CVE-2026-57306 4.2 Moyenne

    Jenkins Project Jenkins Zowe zDevOps Plugin · Jenkins zowe zdevops

    A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

  80. CVE-2026-57305 5.4 Moyenne

    Jenkins Project Jenkins Assembla Plugin · Jenkins assembla

    A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified username and password.

  81. CVE-2026-57304 5.4 Moyenne

    Jenkins Project Jenkins Assembla Plugin · Jenkins assembla

    A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password.

  82. CVE-2026-57303 7.1 Élevée

    Jenkins Project Jenkins Assembla Plugin · Jenkins assembla

    Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.

  83. CVE-2026-57302 4.3 Moyenne

    Jenkins Project Jenkins FitNesse Plugin · Jenkins fitnesse

    Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

  84. CVE-2026-57301 8.8 Élevée

    Jenkins Project Jenkins OWASP ZAP Plugin · Jenkins official owasp zap

    Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

  85. CVE-2026-57300 4.3 Moyenne

    Jenkins Project Jenkins MCP Server Plugin · Jenkins mcp server

    A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.

  86. CVE-2026-57299 4.3 Moyenne

    Jenkins Project Jenkins Contrast Continuous Application Security Plugin · Jenkins contrast continuous application security

    Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata.

  87. CVE-2026-57298 5.4 Moyenne

    Jenkins Project Jenkins Contrast Continuous Application Security Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers to have Jenkins connect to an attacker-specified URL using an attacker-specified username, API key, and service key.

  88. CVE-2026-57297 4.3 Moyenne

    Jenkins Project Jenkins Contrast Continuous Application Security Plugin · Jenkins contrast continuous application security

    A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key.

  89. CVE-2026-57296 8.8 Élevée

    Jenkins Project Jenkins External Workspace Manager Plugin

    Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution.

  90. CVE-2026-57295 5.4 Moyenne

    Jenkins Project Jenkins EC2 Fleet Plugin · Jenkins ec2 fleet

    A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.

  91. CVE-2026-57294 5.4 Moyenne

    Jenkins Project Jenkins EC2 Fleet Plugin · Jenkins ec2 fleet

    A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.

  92. CVE-2026-57293 4.3 Moyenne

    Jenkins Project Jenkins Gitee Plugin

    An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins.

  93. CVE-2026-57292 5.4 Moyenne

    Jenkins Project Jenkins Gitee Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.

  94. CVE-2026-57291 5.4 Moyenne

    Jenkins Project Jenkins Gitee Plugin

    Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.

  95. CVE-2026-57290 4.3 Moyenne

    Jenkins Project Jenkins Priority Sorter Plugin · Jenkins priority sorter

    A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration.

  96. CVE-2026-57289 4.8 Moyenne

    Jenkins Project Jenkins Bitbucket Push and Pull Request Plugin · Jenkins bitbucket push and pull request

    Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to capture the token.

  97. CVE-2026-57288 3.7 Faible

    Jenkins Project Jenkins Active Directory Plugin · Jenkins active directory

    Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name.

  98. CVE-2026-57287 4.3 Moyenne

    Jenkins Project Jenkins Job Configuration History Plugin · Jenkins job configuration history

    Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.

  99. CVE-2026-57286 4.3 Moyenne

    Jenkins Project Jenkins Git Parameter Plugin · Jenkins git parameter

    A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository used by a job, such as branch names, tag names, and revision metadata.

  100. CVE-2026-57285 4.3 Moyenne

    Jenkins Project Jenkins GitHub Branch Source Plugin · Jenkins github branch source

    A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.

  101. CVE-2026-57284 4.3 Moyenne

    Jenkins Project Jenkins Pipeline: Groovy Plugin · Jenkins pipeline\

    Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to instantiate types related to job or system configuration other than Pipeline steps.

  102. CVE-2026-57283 4.3 Moyenne

    Jenkins Project Jenkins Pipeline: Groovy Plugin · Jenkins pipeline\

    A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types related to job or system configuration other than Pipeline steps through the Pipeline Snippet Generator.

  103. CVE-2026-57282 5.0 Moyenne

    Jenkins Project Jenkins Git client Plugin · Jenkins git client

    Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH wrapper script, allowing attackers able to control the name of a build's working directory to execute arbitrary operating system commands on the agent.

  104. CVE-2026-57281 7.5 Élevée

    Jenkins Project Jenkins Script Security Plugin · Red Hat OpenShift Developer Tools and Services 4.12 · Red Hat OpenShift Developer Tools and Services 4.13 · Red Hat OpenShift Developer Tools and Services 4.14

    Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.

  105. CVE-2026-57280 8.8 Élevée

    Jenkins Project Jenkins Script Security Plugin · Jenkins script security

    Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.

  106. CVE-2026-53442 5.3 Moyenne

    Jenkins Project Jenkins · Jenkins jenkins

    Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.

  107. CVE-2026-53441 5.4 Moyenne

    Jenkins Project Jenkins · Jenkins jenkins

    Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

  108. CVE-2026-53440 4.3 Moyenne

    Jenkins Project Jenkins · Jenkins jenkins

    Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain.

  109. CVE-2026-53439 4.3 Moyenne

    Jenkins Project Jenkins · Jenkins jenkins

    Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine other users' configured timezone and to enumerate view names of other users' "My Views".

  110. CVE-2026-53438 4.3 Moyenne

    Jenkins Project Jenkins · Jenkins jenkins

    A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read permission, to cancel queue items they do not have permission to view.

  111. CVE-2026-53437 4.3 Moyenne

    Jenkins Project Jenkins · Red Hat OpenShift Developer Tools and Services 4.12 · Red Hat OpenShift Developer Tools and Services 4.13 · Red Hat OpenShift Developer Tools and Services 4.14

    Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.

  112. CVE-2026-53436 4.3 Moyenne

    Jenkins Project Jenkins · Jenkins jenkins

    Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains relative path segments (`./` or `../`), allowing attackers to perform phishing attacks.

  113. CVE-2026-53435 8.8 Élevée

    Jenkins Project Jenkins · Red Hat OpenShift Developer Tools and Services 4.12 · Red Hat OpenShift Developer Tools and Services 4.13 · Red Hat OpenShift Developer Tools and Services 4.14

    In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

  114. CVE-2026-10276 6.3 Moyenne

    hekmon8 Jenkins-server-mcp

    A vulnerability has been found in hekmon8 Jenkins-server-mcp 0.1.0. This vulnerability affects the function jobPath of the file src/index.ts of the component get_build_status/get_build_log/trigger_build. Such manipulation leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

  115. CVE-2026-9674 4.3 Moyenne

    Jenkins Project Jenkins Multijob Plugin · Jenkins multijob

    A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failed Multijob builds.

  116. CVE-2026-48927 5.5 Moyenne

    Jenkins Project Jenkins buildgraph-view Plugin · Jenkins buildgraph-view

    Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or views.

  117. CVE-2026-48926 4.3 Moyenne

    Jenkins Project Jenkins Job Import Plugin · Jenkins job import

    Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

  118. CVE-2026-48925 4.3 Moyenne

    Jenkins Project Jenkins GitHub Integration Plugin · Kostyasha github integration

    A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a pull request.

  119. CVE-2026-48924 4.3 Moyenne

    Jenkins Project Jenkins Bitbucket OAuth Plugin · Jenkins bitbucket oauth

    Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

  120. CVE-2026-48923 4.3 Moyenne

    Jenkins Project Jenkins AppSpider Plugin · Jenkins appspider

    Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.

  121. CVE-2026-48922 7.5 Élevée

    Jenkins Project Jenkins Credentials Binding Plugin · Jenkins credentials binding

    Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.

  122. CVE-2026-48921 7.5 Élevée

    Jenkins Project Jenkins Pipeline: Groovy Libraries Plugin · Jenkins pipeline\

    Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.

  123. CVE-2026-48920 8.8 Élevée

    Jenkins Project Jenkins Email Extension Plugin · Jenkins email extension

    Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify `file:` URLs for images to read arbitrary files from the Jenkins controller filesystem.

  124. CVE-2026-48919 6.6 Moyenne

    Jenkins Project Jenkins Active Directory Plugin · Jenkins active directory

    Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.

  125. CVE-2026-48918 6.6 Moyenne

    Jenkins Project Jenkins Active Directory Plugin · Jenkins active directory

    Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.

  126. CVE-2026-48917 6.6 Moyenne

    Jenkins Project Jenkins LDAP Plugin · Jenkins ldap

    Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.

  127. CVE-2026-48916 6.6 Moyenne

    Jenkins Project Jenkins LDAP Plugin · Jenkins ldap

    Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.