Jenkins vulnerabilities6 known to be exploited.
Jenkins has 1,665 published vulnerabilities across 695 products in our catalogue. 6 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Jenkins, with 255. If you run Jenkins software, patch the exploited flaws first.
The most recent Jenkins flaw added to the known-exploited list is CVE-2017-1000353, on 2 October 2025. We keep watching the known-exploited list.
Which Jenkins products have the most vulnerabilities?
Jenkins leads with 255 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Jenkins vulnerabilities are being exploited?
6 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.8Jenkins Remote Code Execution Vulnerability
Jenkins contains a remote code execution vulnerability.
- 9.8Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.
- 7.5HTTP/2 Rapid Reset Attack Vulnerability
HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).
- 7.5Jenkins User Interface (UI) Information Disclosure Vulnerability
Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages.
- 9.9Jenkins Script Security Plugin Sandbox Bypass Vulnerability
Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.
- 9.8Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
A code execution vulnerability exists in the Stapler web framework used by Jenkins
Which Jenkins flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution.
- 98%CVE-2019-1003000High
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to...
- 98%
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to...
- 97%CVE-2016-9299Critical
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.
- 93%CVE-2020-2096Medium
Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.
- 91%CVE-2018-1000600High
A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified...
- 88%CVE-2021-21699Medium
Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable...
- 87%CVE-2015-8103Critical
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic...
- 86%CVE-2018-1999002High
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests...
- 83%CVE-2016-0792High
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
All Jenkins products we track.
653 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Jenkinsjenkins255 vulnerabilities1,275 versions
- Script Securityscript_security32 vulnerabilities126 versions
- Blue Oceanblue_ocean11 vulnerabilities92 versions
- Gitgit11 vulnerabilities167 versions
- Email Extensionemail_extension10 vulnerabilities121 versions
- Active Directoryactive_directory9 vulnerabilities82 versions
- Build Failure Analyzerbuild_failure_analyzer9 vulnerabilities62 versions
- Config File Providerconfig_file_provider9 vulnerabilities74 versions
- Configuration As Codeconfiguration_as_code9 vulnerabilities69 versions
- Ns-Nd Integration Performance Publisherns-nd_integration_performance_publisher8 vulnerabilities5 versions
- Kuberneteskubernetes7 vulnerabilities82 versions
- Openid Connect Authenticationopenid_connect_authentication7 vulnerabilities57 versions
- Openshift Deployeropenshift_deployer7 vulnerabilities7 versions
- Rundeckrundeck7 vulnerabilities46 versions
- Subversionsubversion7 vulnerabilities107 versions
- Amazon Ec2amazon_ec26 vulnerabilities58 versions
- Azure VM Agentsazure_vm_agents6 vulnerabilities25 versions
- Credentials Bindingcredentials_binding6 vulnerabilities33 versions
- Deployment Dashboarddeployment_dashboard6 vulnerabilities6 versions
- Electricflowelectricflow6 vulnerabilities7 versions
- Gerrit Triggergerrit_trigger6 vulnerabilities79 versions
- Github Branch Sourcegithub_branch_source6 vulnerabilities44 versions
- Github Pull Request Buildergithub_pull_request_builder6 vulnerabilities122 versions
- GitLabgitlab6 vulnerabilities122 versions
This directory lists the 653 Jenkins products with at least one tracked version, of 695 in our catalogue.
Running Jenkins? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.
- Matched to
- Jenkins on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 1,665 published vulnerabilities across 695 products and 14,592 versions from Jenkins. The most recent Jenkins flaw added to the known-exploited list is CVE-2017-1000353, on 2 October 2025.
6 Jenkins vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2017-1000353, CVE-2024-23897 and CVE-2023-44487. The full list is on this page.
Jenkins, with 255 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Jenkins products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.