Technology · Maven

org.jenkins-ci.main:jenkins-core (Maven) vulnerabilities

Updated 9 November 2026, 03:07 UTC. Rebuilt every hour.

Junglewise Threat Intelligence has tracked 259 vulnerabilities in org.jenkins-ci.main:jenkins-core (Maven): 0 in the last 7 days and 0 in the last 90 days, 5 of them critical and 4 exploited in the wild. The most recent, CVE-2026-53442, was published on 10 June 2026.

Last 7 days: 0
Last 90 days: 0
Critical, all time: 5
Exploited in the wild: 4

About org.jenkins-ci.main:jenkins-core (Maven)

The core library and execution engine for the Jenkins continuous integration and delivery server.

Homepage

Latest org.jenkins-ci.main:jenkins-core (Maven) vulnerabilities

CVE-2026-53442: Jenkins plaintext secret storage in job config.xml submissionsmediumCVSS 5.3EPSS 0.2%10 Jun 2026
CVE-2026-53441: Jenkins stored XSS in node offline cause descriptionhighCVSS 8EPSS 0.3%10 Jun 2026
CVE-2026-53440: Jenkins open redirect in Delegate to servlet container security realmmediumCVSS 4.3EPSS 0.4%10 Jun 2026
CVE-2026-53439: Jenkins missing permission checks in user profile endpointsmediumCVSS 4.3EPSS 0.3%10 Jun 2026
CVE-2026-53438: Jenkins missing permission check in queue item cancellationmediumCVSS 4.3EPSS 0.3%10 Jun 2026
CVE-2026-53437: Jenkins open redirect via tab or newline characters in login URLmediumCVSS 4.3EPSS 0.7%10 Jun 2026
CVE-2026-53436: Jenkins open redirect via relative path segments in login flowmediumCVSS 4.3EPSS 0.4%10 Jun 2026
CVE-2026-53435: Jenkins arbitrary type deserialization in config.xml processinghighCVSS 8.8EPSS 2.2%10 Jun 2026
CVE-2026-33002: Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validationlowCVSS 3.1EPSS 0.4%18 Mar 2026
CVE-2026-33001: Jenkins arbitrary file write via symbolic link extraction in archiveshighCVSS 8.8EPSS 0.7%18 Mar 2026
CVE-2026-27100: Jenkins has a build information disclosure vulnerability through Run ParameterlowCVSS 3.1EPSS 0.4%18 Feb 2026
CVE-2026-27099: Jenkins has a stored XSS vulnerability in node offline cause descriptionlowCVSS 3.1EPSS 0.6%18 Feb 2026
CVE-2025-67639: Jenkins has a CSRF vulnerability on the login formlowCVSS 3.5EPSS 0.2%10 Dec 2025
CVE-2025-67638: Jenkins's build authorization token is stored and displayed in plain textmediumCVSS 4.3EPSS 0.2%10 Dec 2025
CVE-2025-67637: Jenkins's build authorization token is stored and displayed in plain textmediumCVSS 4.3EPSS 0.2%10 Dec 2025
CVE-2025-67636: Jenkins is missing a permission check on password fieldsmediumCVSS 4.3EPSS 0.3%10 Dec 2025
CVE-2025-67635: Jenkins has a Denial of service vulnerability in HTTP-based CLIhighCVSS 7.5EPSS 0.6%10 Dec 2025
CVE-2025-59476: Jenkins has a log message injection vulnerabilitylowCVSS 3.1EPSS 0.4%17 Sep 2025
CVE-2025-59474: Jenkins has a missing permission check, allowing users to obtain agent nameslowCVSS 3.1EPSS 4.9%17 Sep 2025
CVE-2025-59475: Jenkins is missing a permission check in the authenticated users' profile menulowCVSS 3.1EPSS 0.5%17 Sep 2025
CVE-2025-31720: Jenkins Missing Permission ChecklowCVSS 3.1EPSS 0.4%2 Apr 2025
CVE-2025-31721: Jenkins Missing Permission ChecklowCVSS 3.1EPSS 0.4%2 Apr 2025
CVE-2025-27623: Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permissionlowCVSS 3.1EPSS 0.3%6 Mar 2025
CVE-2025-27625: Jenkins Open Redirect vulnerabilitylowCVSS 3.1EPSS 0.6%6 Mar 2025
CVE-2025-27622: Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permissionlowCVSS 3.1EPSS 0.8%6 Mar 2025

Most severe org.jenkins-ci.main:jenkins-core (Maven) vulnerabilities

Exploited in the wild first, then by severity and CVSS score.

CVE-2024-23897: Arbitrary file read vulnerability through the Jenkins CLI can lead to RCEcriticalexploited in the wildCVSS 3.1EPSS 100.0%24 Jan 2024
CVE-2015-5317: Jenkins discloses project names via fingerprintscriticalexploited in the wildCVSS 3.1EPSS 23.0%13 May 2022
CVE-2017-1000353: Deserialization of Untrusted Data in Jenkinscriticalexploited in the wildCVSS 3EPSS 99.7%13 May 2022
CVE-2018-1000861: Deserialization of Untrusted Data in Jenkinscriticalexploited in the wildCVSS 3EPSS 98.3%13 May 2022
CVE-2016-9299: Jenkins remoting module Java deserialization RCE via LDAP querycriticalCVSS 9.8EPSS 96.9%12 Jan 2017
CVE-2026-53435: Jenkins arbitrary type deserialization in config.xml processinghighCVSS 8.8EPSS 2.2%10 Jun 2026
CVE-2026-33001: Jenkins arbitrary file write via symbolic link extraction in archiveshighCVSS 8.8EPSS 0.7%18 Mar 2026
CVE-2026-53441: Jenkins stored XSS in node offline cause descriptionhighCVSS 8EPSS 0.3%10 Jun 2026
CVE-2025-67635: Jenkins has a Denial of service vulnerability in HTTP-based CLIhighCVSS 7.5EPSS 0.6%10 Dec 2025
CVE-2026-53442: Jenkins plaintext secret storage in job config.xml submissionsmediumCVSS 5.3EPSS 0.2%10 Jun 2026

Vulnerabilities per week

Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.

Vulnerabilities published per week, UTC
Week of	Bar	Vulns	Critical
17 Aug 2026		0	0
24 Aug 2026		0	0
31 Aug 2026		0	0
7 Sep 2026		0	0
14 Sep 2026		0	0
21 Sep 2026		0	0
28 Sep 2026		0	0
5 Oct 2026		0	0
12 Oct 2026		0	0
19 Oct 2026		0	0
26 Oct 2026		0	0
2 Nov 2026		0	0
9 Nov 2026		0	0

Embed a badge

A live badge for a README, a status page or an internal wiki: how many org.jenkins-ci.main:jenkins-core (Maven) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.

[![org.jenkins-ci.main:jenkins-core (Maven) vulnerabilities](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core/badge.svg)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core)

<a href="https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core"><img src="https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core/badge.svg" alt="org.jenkins-ci.main:jenkins-core (Maven) vulnerabilities" /></a>

How this is built

Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.

The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.

Use this data

The same data is at https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core.json, and this page as text at https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.

Cite as: Junglewise Threat Intelligence, "org.jenkins-ci.main:jenkins-core (Maven) vulnerabilities", https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core, 9 November 2026.