Jenkins project
Number 17 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: Jenkins Project, Jenkins project
Total vulnerabilities
1,613
Critical
31
High
146
Known Exploited
3
Exploit available
3
Network, no login needed
33.6%
Of 532 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 153 | 2 | 53 | 93 | 5 | 0 |
| 2025 | 97 | 4 | 12 | 79 | 2 | 0 |
| 2024 | 49 | 2 | 17 | 29 | 1 | 0 |
| 2023 | 243 | 12 | 43 | 82 | 1 | 105 |
| 2022 | 391 | 9 | 21 | 62 | 1 | 298 |
| 2021 | 103 | 0 | 0 | 0 | 0 | 103 |
| 2020 | 236 | 0 | 0 | 0 | 0 | 236 |
| 2019 | 338 | 2 | 0 | 0 | 0 | 336 |
| 2018 | 3 | 0 | 0 | 0 | 0 | 3 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| Jenkins | 152 | 30 |
| Jenkins Script Security Plugin | 39 | 14 |
| Jenkins Active Directory Plugin | 11 | 0 |
| Jenkins Pipeline: Groovy Plugin | 11 | 2 |
| Jenkins Email Extension Plugin | 9 | 2 |
| Jenkins Build Failure Analyzer Plugin | 8 | 0 |
| Jenkins GitLab Plugin | 8 | 0 |
| Jenkins Job Configuration History Plugin | 8 | 0 |
| Jenkins NS-ND Integration Performance Publisher Plugin | 8 | 5 |
| Jenkins OpenId Connect Authentication Plugin | 8 | 5 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Missing Authorization | 95 | 7 |
| Cross-Site Request Forgery | 70 | 30 |
| Cross-Site Scripting | 66 | 19 |
| Path Traversal | 24 | 12 |
| XML External Entity | 22 | 20 |
| Cleartext Storage of Sensitive Information | 20 | 0 |
| Credential Exposure | 18 | 2 |
| Missing Encryption of Sensitive Data | 16 | 0 |
| Protection Mechanism Failure | 15 | 8 |
| Insecure Deserialization | 13 | 8 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2024-23897 | Jenkins Project Jenkins: Path Traversal | Critical | 100.0% | |
| CVE-2019-1003030 | Jenkins project Jenkins Pipeline: Groovy Plugin vulnerability | Critical | 97.1% | |
| CVE-2019-1003029 | Jenkins project Jenkins Script Security Plugin vulnerability | Critical | 74.4% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-117626 | Jenkins Project Jenkins: Path Traversal | Medium | 0.3% | |
| CVE-2026-117625 | Jenkins Project Jenkins: Missing Authorization | Medium | 0.2% | |
| CVE-2026-117624 | Jenkins Project Jenkins: Insecure Deserialization | High | 0.4% | |
| CVE-2026-117623 | Jenkins Project Jenkins: Cross-Site Scripting | Medium | 0.3% | |
| CVE-2026-117622 | Jenkins Project Jenkins: Cross-Site Scripting | Medium | 0.3% | |
| CVE-2026-117621 | Jenkins Project Jenkins: Cross-Site Scripting | Medium | 0.3% | |
| CVE-2026-117620 | Jenkins Project Jenkins: Code Injection | High | 0.4% | |
| CVE-2026-117619 | Jenkins Project Jenkins vulnerability | High | 0.3% | |
| CVE-2026-117618 | Jenkins Project Jenkins: Race Condition | High | 0.3% | |
| CVE-2026-117617 | Jenkins Project Jenkins vulnerability | High | 0.5% |