# org.jenkins-ci.main:jenkins-core (Maven) vulnerabilities Source: https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 259 vulnerabilities in org.jenkins-ci.main:jenkins-core (Maven): 0 in the last 7 days and 0 in the last 90 days, 5 of them critical and 4 exploited in the wild. The most recent, CVE-2026-53442, was published on 10 June 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 259 (5 critical, 4 exploited in the wild) ## About org.jenkins-ci.main:jenkins-core (Maven) The core library and execution engine for the Jenkins continuous integration and delivery server. ## Latest org.jenkins-ci.main:jenkins-core (Maven) vulnerabilities - [CVE-2026-53442: Jenkins plaintext secret storage in job config.xml submissions](https://junglewise.ai/threats/cve-2026-53442-jenkins-plaintext-secret-storage-in-job-config-xml-submissions) (medium, CVSS 5.3, published 10 Jun 2026) - [CVE-2026-53441: Jenkins stored XSS in node offline cause description](https://junglewise.ai/threats/cve-2026-53441-jenkins-stored-xss-in-node-offline-cause-description) (high, CVSS 8, published 10 Jun 2026) - [CVE-2026-53440: Jenkins open redirect in Delegate to servlet container security realm](https://junglewise.ai/threats/cve-2026-53440-jenkins-open-redirect-in-delegate-to-servlet-container-security) (medium, CVSS 4.3, published 10 Jun 2026) - [CVE-2026-53439: Jenkins missing permission checks in user profile endpoints](https://junglewise.ai/threats/cve-2026-53439-jenkins-missing-permission-checks-in-user-profile-endpoints) (medium, CVSS 4.3, published 10 Jun 2026) - [CVE-2026-53438: Jenkins missing permission check in queue item cancellation](https://junglewise.ai/threats/cve-2026-53438-jenkins-missing-permission-check-in-queue-item-cancellation) (medium, CVSS 4.3, published 10 Jun 2026) - [CVE-2026-53437: Jenkins open redirect via tab or newline characters in login URL](https://junglewise.ai/threats/cve-2026-53437-jenkins-open-redirect-via-tab-or-newline-characters-in-login-url) (medium, CVSS 4.3, published 10 Jun 2026) - [CVE-2026-53436: Jenkins open redirect via relative path segments in login flow](https://junglewise.ai/threats/cve-2026-53436-jenkins-open-redirect-via-relative-path-segments-in-login-flow) (medium, CVSS 4.3, published 10 Jun 2026) - [CVE-2026-53435: Jenkins arbitrary type deserialization in config.xml processing](https://junglewise.ai/threats/cve-2026-53435-jenkins-arbitrary-type-deserialization-in-config-xml-processing) (high, CVSS 8.8, published 10 Jun 2026) - [CVE-2026-33002: Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation](https://junglewise.ai/threats/cve-2026-33002-jenkins-has-a-dns-rebinding-vulnerability-in-websocket-cli-origin) (low, CVSS 3.1, published 18 Mar 2026) - [CVE-2026-33001: Jenkins arbitrary file write via symbolic link extraction in archives](https://junglewise.ai/threats/cve-2026-33001-jenkins-arbitrary-file-write-via-symbolic-link-extraction-in) (high, CVSS 8.8, published 18 Mar 2026) - [CVE-2026-27100: Jenkins has a build information disclosure vulnerability through Run Parameter](https://junglewise.ai/threats/cve-2026-27100-jenkins-has-a-build-information-disclosure-vulnerability-through) (low, CVSS 3.1, published 18 Feb 2026) - [CVE-2026-27099: Jenkins has a stored XSS vulnerability in node offline cause description](https://junglewise.ai/threats/cve-2026-27099-jenkins-has-a-stored-xss-vulnerability-in-node-offline-cause) (low, CVSS 3.1, published 18 Feb 2026) - [CVE-2025-67639: Jenkins has a CSRF vulnerability on the login form](https://junglewise.ai/threats/cve-2025-67639-jenkins-has-a-csrf-vulnerability-on-the-login-form) (low, CVSS 3.5, published 10 Dec 2025) - [CVE-2025-67638: Jenkins's build authorization token is stored and displayed in plain text](https://junglewise.ai/threats/cve-2025-67638-jenkins-s-build-authorization-token-is-stored-and-displayed-in) (medium, CVSS 4.3, published 10 Dec 2025) - [CVE-2025-67637: Jenkins's build authorization token is stored and displayed in plain text](https://junglewise.ai/threats/cve-2025-67637-jenkins-s-build-authorization-token-is-stored-and-displayed-in) (medium, CVSS 4.3, published 10 Dec 2025) - [CVE-2025-67636: Jenkins is missing a permission check on password fields](https://junglewise.ai/threats/cve-2025-67636-jenkins-is-missing-a-permission-check-on-password-fields) (medium, CVSS 4.3, published 10 Dec 2025) - [CVE-2025-67635: Jenkins has a Denial of service vulnerability in HTTP-based CLI](https://junglewise.ai/threats/cve-2025-67635-jenkins-has-a-denial-of-service-vulnerability-in-http-based-cli) (high, CVSS 7.5, published 10 Dec 2025) - [CVE-2025-59476: Jenkins has a log message injection vulnerability](https://junglewise.ai/threats/cve-2025-59476-jenkins-has-a-log-message-injection-vulnerability) (low, CVSS 3.1, published 17 Sep 2025) - [CVE-2025-59474: Jenkins has a missing permission check, allowing users to obtain agent names](https://junglewise.ai/threats/cve-2025-59474-jenkins-has-a-missing-permission-check-allowing-users-to-obtain) (low, CVSS 3.1, published 17 Sep 2025) - [CVE-2025-59475: Jenkins is missing a permission check in the authenticated users' profile menu](https://junglewise.ai/threats/cve-2025-59475-jenkins-is-missing-a-permission-check-in-the-authenticated-users) (low, CVSS 3.1, published 17 Sep 2025) - [CVE-2025-31720: Jenkins Missing Permission Check](https://junglewise.ai/threats/cve-2025-31720-jenkins-missing-permission-check) (low, CVSS 3.1, published 2 Apr 2025) - [CVE-2025-31721: Jenkins Missing Permission Check](https://junglewise.ai/threats/cve-2025-31721-jenkins-missing-permission-check) (low, CVSS 3.1, published 2 Apr 2025) - [CVE-2025-27623: Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission](https://junglewise.ai/threats/cve-2025-27623-jenkins-reveals-encrypted-values-of-secrets-stored-in-agent) (low, CVSS 3.1, published 6 Mar 2025) - [CVE-2025-27625: Jenkins Open Redirect vulnerability](https://junglewise.ai/threats/cve-2025-27625-jenkins-open-redirect-vulnerability) (low, CVSS 3.1, published 6 Mar 2025) - [CVE-2025-27622: Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission](https://junglewise.ai/threats/cve-2025-27622-jenkins-reveals-encrypted-values-of-secrets-stored-in-agent) (low, CVSS 3.1, published 6 Mar 2025) ## Most severe org.jenkins-ci.main:jenkins-core (Maven) vulnerabilities - [CVE-2024-23897: Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE](https://junglewise.ai/threats/cve-2024-23897-jenkins-command-line-interface-cli-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 24 Jan 2024) - [CVE-2015-5317: Jenkins discloses project names via fingerprints](https://junglewise.ai/threats/cve-2015-5317-jenkins-user-interface-ui-information-disclosure-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 13 May 2022) - [CVE-2017-1000353: Deserialization of Untrusted Data in Jenkins](https://junglewise.ai/threats/cve-2017-1000353-jenkins-remote-code-execution-via-cli-java-deserialization) (critical, exploited in the wild, CVSS 3, published 13 May 2022) - [CVE-2018-1000861: Deserialization of Untrusted Data in Jenkins](https://junglewise.ai/threats/cve-2018-1000861-jenkins-stapler-web-framework-deserialization-of-untrusted-data) (critical, exploited in the wild, CVSS 3, published 13 May 2022) - [CVE-2016-9299: Jenkins remoting module Java deserialization RCE via LDAP query](https://junglewise.ai/threats/cve-2016-9299-jenkins-remoting-module-java-deserialization-rce-via-ldap-query) (critical, CVSS 9.8, published 12 Jan 2017) - [CVE-2026-53435: Jenkins arbitrary type deserialization in config.xml processing](https://junglewise.ai/threats/cve-2026-53435-jenkins-arbitrary-type-deserialization-in-config-xml-processing) (high, CVSS 8.8, published 10 Jun 2026) - [CVE-2026-33001: Jenkins arbitrary file write via symbolic link extraction in archives](https://junglewise.ai/threats/cve-2026-33001-jenkins-arbitrary-file-write-via-symbolic-link-extraction-in) (high, CVSS 8.8, published 18 Mar 2026) - [CVE-2026-53441: Jenkins stored XSS in node offline cause description](https://junglewise.ai/threats/cve-2026-53441-jenkins-stored-xss-in-node-offline-cause-description) (high, CVSS 8, published 10 Jun 2026) - [CVE-2025-67635: Jenkins has a Denial of service vulnerability in HTTP-based CLI](https://junglewise.ai/threats/cve-2025-67635-jenkins-has-a-denial-of-service-vulnerability-in-http-based-cli) (high, CVSS 7.5, published 10 Dec 2025) - [CVE-2026-53442: Jenkins plaintext secret storage in job config.xml submissions](https://junglewise.ai/threats/cve-2026-53442-jenkins-plaintext-secret-storage-in-job-config-xml-submissions) (medium, CVSS 5.3, published 10 Jun 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Maven technologies - [org.apache.tomcat:tomcat (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat): 169 vulnerabilities - [com.liferay.portal:release.portal.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-portal-bom): 159 vulnerabilities - [com.liferay.portal:release.dxp.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-dxp-bom): 125 vulnerabilities - [org.keycloak:keycloak-services (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services): 122 vulnerabilities - [com.fasterxml.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind): 86 vulnerabilities - [org.apache.tomcat.embed:tomcat-embed-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core): 83 vulnerabilities - [org.apache.struts:struts2-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core): 60 vulnerabilities - [org.keycloak:keycloak-core (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-core): 57 vulnerabilities - [org.xwiki.platform:xwiki-platform-oldcore (Maven)](https://junglewise.ai/threats/technologies/org-xwiki-platform-xwiki-platform-oldcore): 46 vulnerabilities - [org.apache.tomcat:tomcat-catalina (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina): 44 vulnerabilities - [org.elasticsearch:elasticsearch (Maven)](https://junglewise.ai/threats/technologies/org-elasticsearch-elasticsearch): 41 vulnerabilities - [io.undertow:undertow-core (Maven)](https://junglewise.ai/threats/technologies/io-undertow-undertow-core): 40 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "org.jenkins-ci.main:jenkins-core (Maven) vulnerabilities", https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core, 9 November 2026.