{"schema_version":1,"title":"Jenkins Project vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 30 vulnerabilities in Jenkins Project: 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 1 exploited in the wild. The most recent, CVE-2026-57307, was published on 24 June 2026. 3 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/jenkins-project","json_url":"https://junglewise.ai/threats/vendors/jenkins-project.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/jenkins-project","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":4,"all_time":30,"critical":1,"exploited":1,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":29},"latest":[{"cve":"CVE-2026-57307","cvss":4.2,"epss":0.0021,"slug":"cve-2026-57307-jenkins-zowe-zdevops-plugin-missing-permission-check-in","title":"Jenkins Zowe zDevOps Plugin missing permission check in connection endpoint","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:36.77+00:00","url":"https://junglewise.ai/threats/cve-2026-57307-jenkins-zowe-zdevops-plugin-missing-permission-check-in"},{"cve":"CVE-2026-57306","cvss":4.2,"epss":0.0018,"slug":"cve-2026-57306-jenkins-zowe-zdevops-plugin-csrf-in-credential-connection","title":"Jenkins Zowe zDevOps Plugin CSRF in credential connection endpoint","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:36.68+00:00","url":"https://junglewise.ai/threats/cve-2026-57306-jenkins-zowe-zdevops-plugin-csrf-in-credential-connection"},{"cve":"CVE-2026-57305","cvss":5.4,"epss":0.0022,"slug":"cve-2026-57305-jenkins-assembla-plugin-csrf-in-connection-endpoint","title":"Jenkins Assembla Plugin CSRF in connection endpoint","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:36.593+00:00","url":"https://junglewise.ai/threats/cve-2026-57305-jenkins-assembla-plugin-csrf-in-connection-endpoint"},{"cve":"CVE-2026-57304","cvss":5.4,"epss":0.0025,"slug":"cve-2026-57304-jenkins-assembla-plugin-missing-permission-check-in-connection","title":"Jenkins Assembla Plugin missing permission check in connection endpoint","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:36.497+00:00","url":"https://junglewise.ai/threats/cve-2026-57304-jenkins-assembla-plugin-missing-permission-check-in-connection"},{"cve":"CVE-2026-57303","cvss":7.1,"epss":0.0036,"slug":"cve-2026-57303-jenkins-assembla-plugin-xxe-in-xml-parser","title":"Jenkins Assembla Plugin XXE in XML parser","severity":"high","exploited":false,"published_at":"2026-06-24T14:17:36.407+00:00","url":"https://junglewise.ai/threats/cve-2026-57303-jenkins-assembla-plugin-xxe-in-xml-parser"},{"cve":"CVE-2026-57302","cvss":4.3,"epss":0.0028,"slug":"cve-2026-57302-jenkins-fitnesse-plugin-cleartext-storage-of-passwords-in-job","title":"Jenkins FitNesse Plugin cleartext storage of passwords in job config","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:36.32+00:00","url":"https://junglewise.ai/threats/cve-2026-57302-jenkins-fitnesse-plugin-cleartext-storage-of-passwords-in-job"},{"cve":"CVE-2026-57301","cvss":8.8,"epss":0.0063,"slug":"cve-2026-57301-jenkins-owasp-zap-plugin-arbitrary-code-execution-on-controller","title":"Jenkins OWASP ZAP Plugin arbitrary code execution on controller","severity":"high","exploited":false,"published_at":"2026-06-24T14:17:36.23+00:00","url":"https://junglewise.ai/threats/cve-2026-57301-jenkins-owasp-zap-plugin-arbitrary-code-execution-on-controller"},{"cve":"CVE-2026-57300","cvss":4.3,"epss":0.0028,"slug":"cve-2026-57300-jenkins-mcp-server-plugin-missing-permission-check-in-pipeline","title":"Jenkins MCP Server Plugin missing permission check in Pipeline replay scripts","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:36.14+00:00","url":"https://junglewise.ai/threats/cve-2026-57300-jenkins-mcp-server-plugin-missing-permission-check-in-pipeline"},{"cve":"CVE-2026-57299","cvss":4.3,"epss":0.0025,"slug":"cve-2026-57299-jenkins-contrast-continuous-application-security-plugin-missing","title":"Jenkins Contrast Continuous Application Security Plugin missing permission check","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:36.053+00:00","url":"https://junglewise.ai/threats/cve-2026-57299-jenkins-contrast-continuous-application-security-plugin-missing"},{"cve":"CVE-2026-57298","cvss":5.4,"epss":0.0014,"slug":"cve-2026-57298-jenkins-contrast-continuous-application-security-plugin-csrf","title":"Jenkins Contrast Continuous Application Security Plugin CSRF","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:35.97+00:00","url":"https://junglewise.ai/threats/cve-2026-57298-jenkins-contrast-continuous-application-security-plugin-csrf"},{"cve":"CVE-2026-57297","cvss":4.3,"epss":0.0025,"slug":"cve-2026-57297-jenkins-contrast-continuous-application-security-plugin-missing","title":"Jenkins Contrast Continuous Application Security Plugin missing permission check","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:35.877+00:00","url":"https://junglewise.ai/threats/cve-2026-57297-jenkins-contrast-continuous-application-security-plugin-missing"},{"cve":"CVE-2026-57296","cvss":8.8,"epss":0.0084,"slug":"cve-2026-57296-jenkins-external-workspace-manager-plugin-path-traversal-in","title":"Jenkins External Workspace Manager Plugin path traversal in exwsAllocate","severity":"high","exploited":false,"published_at":"2026-06-24T14:17:35.79+00:00","url":"https://junglewise.ai/threats/cve-2026-57296-jenkins-external-workspace-manager-plugin-path-traversal-in"},{"cve":"CVE-2026-57295","cvss":5.4,"epss":0.0022,"slug":"cve-2026-57295-jenkins-ec2-fleet-plugin-csrf-in-aws-credential-connection","title":"Jenkins EC2 Fleet Plugin CSRF in AWS credential connection","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:35.703+00:00","url":"https://junglewise.ai/threats/cve-2026-57295-jenkins-ec2-fleet-plugin-csrf-in-aws-credential-connection"},{"cve":"CVE-2026-57294","cvss":5.4,"epss":0.0025,"slug":"cve-2026-57294-jenkins-ec2-fleet-plugin-missing-permission-check-in-aws","title":"Jenkins EC2 Fleet Plugin missing permission check in AWS credential handling","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:35.613+00:00","url":"https://junglewise.ai/threats/cve-2026-57294-jenkins-ec2-fleet-plugin-missing-permission-check-in-aws"},{"cve":"CVE-2026-57293","cvss":4.3,"epss":0.0027,"slug":"cve-2026-57293-jenkins-gitee-plugin-incorrect-permission-check-allows-credential","title":"Jenkins Gitee Plugin incorrect permission check allows credential ID enumeration","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:35.52+00:00","url":"https://junglewise.ai/threats/cve-2026-57293-jenkins-gitee-plugin-incorrect-permission-check-allows-credential"},{"cve":"CVE-2026-57292","cvss":5.4,"epss":0.0014,"slug":"cve-2026-57292-jenkins-gitee-plugin-csrf-in-connection-endpoint","title":"Jenkins Gitee Plugin CSRF in connection endpoint","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:35.433+00:00","url":"https://junglewise.ai/threats/cve-2026-57292-jenkins-gitee-plugin-csrf-in-connection-endpoint"},{"cve":"CVE-2026-57291","cvss":5.4,"epss":0.0023,"slug":"cve-2026-57291-jenkins-gitee-plugin-missing-permission-check-in-connection","title":"Jenkins Gitee Plugin missing permission check in connection endpoint","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:35.347+00:00","url":"https://junglewise.ai/threats/cve-2026-57291-jenkins-gitee-plugin-missing-permission-check-in-connection"},{"cve":"CVE-2026-57290","cvss":4.3,"epss":0.0025,"slug":"cve-2026-57290-jenkins-priority-sorter-plugin-csrf-in-global-job-priority","title":"Jenkins Priority Sorter Plugin CSRF in global job priority configuration","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:35.253+00:00","url":"https://junglewise.ai/threats/cve-2026-57290-jenkins-priority-sorter-plugin-csrf-in-global-job-priority"},{"cve":"CVE-2026-57289","cvss":4.8,"epss":0.0016,"slug":"cve-2026-57289-jenkins-bitbucket-push-and-pull-request-plugin-disabled-ssl","title":"Jenkins Bitbucket Push and Pull Request Plugin disabled SSL validation","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:35.14+00:00","url":"https://junglewise.ai/threats/cve-2026-57289-jenkins-bitbucket-push-and-pull-request-plugin-disabled-ssl"},{"cve":"CVE-2026-57287","cvss":4.3,"epss":0.002,"slug":"cve-2026-57287-jenkins-job-configuration-history-plugin-information-disclosure","title":"Jenkins Job Configuration History Plugin information disclosure in configuration history","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:34.943+00:00","url":"https://junglewise.ai/threats/cve-2026-57287-jenkins-job-configuration-history-plugin-information-disclosure"},{"cve":"CVE-2026-57286","cvss":4.3,"epss":0.0028,"slug":"cve-2026-57286-jenkins-git-parameter-plugin-missing-permission-check-in-scm","title":"Jenkins Git Parameter Plugin missing permission check in SCM metadata endpoint","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:34.707+00:00","url":"https://junglewise.ai/threats/cve-2026-57286-jenkins-git-parameter-plugin-missing-permission-check-in-scm"},{"cve":"CVE-2026-57285","cvss":4.3,"epss":0.0028,"slug":"cve-2026-57285-jenkins-github-branch-source-plugin-missing-permission-check-in","title":"Jenkins GitHub Branch Source Plugin missing permission check in API endpoint","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:34.45+00:00","url":"https://junglewise.ai/threats/cve-2026-57285-jenkins-github-branch-source-plugin-missing-permission-check-in"},{"cve":"CVE-2026-57284","cvss":4.3,"epss":0.0034,"slug":"cve-2026-57284-jenkins-pipeline-groovy-plugin-unrestricted-instantiation-in","title":"Jenkins Pipeline Groovy Plugin unrestricted instantiation in Snippet Generator","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:34.363+00:00","url":"https://junglewise.ai/threats/cve-2026-57284-jenkins-pipeline-groovy-plugin-unrestricted-instantiation-in"},{"cve":"CVE-2026-57283","cvss":4.3,"epss":0.0024,"slug":"cve-2026-57283-jenkins-pipeline-groovy-plugin-csrf-in-snippet-generator","title":"Jenkins Pipeline Groovy Plugin CSRF in Snippet Generator","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:34.27+00:00","url":"https://junglewise.ai/threats/cve-2026-57283-jenkins-pipeline-groovy-plugin-csrf-in-snippet-generator"},{"cve":"CVE-2026-57282","cvss":5,"epss":0.0025,"slug":"cve-2026-57282-jenkins-git-client-plugin-os-command-injection-in-ssh-wrapper","title":"Jenkins Git client Plugin OS command injection in SSH wrapper script","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:34.14+00:00","url":"https://junglewise.ai/threats/cve-2026-57282-jenkins-git-client-plugin-os-command-injection-in-ssh-wrapper"}],"vendor":{"hub":true,"name":"Jenkins Project","slug":"jenkins-project","homepage":"https://www.jenkins.io","description":"Open source automation server for building, testing, and deploying software.","url":"https://junglewise.ai/threats/vendors/jenkins-project"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2024-23897","cvss":3.1,"epss":1,"slug":"cve-2024-23897-jenkins-command-line-interface-cli-path-traversal-vulnerability","title":"Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE","severity":"critical","exploited":true,"published_at":"2024-01-24T18:31:02+00:00","url":"https://junglewise.ai/threats/cve-2024-23897-jenkins-command-line-interface-cli-path-traversal-vulnerability"},{"cve":"CVE-2026-57296","cvss":8.8,"epss":0.0084,"slug":"cve-2026-57296-jenkins-external-workspace-manager-plugin-path-traversal-in","title":"Jenkins External Workspace Manager Plugin path traversal in exwsAllocate","severity":"high","exploited":false,"published_at":"2026-06-24T14:17:35.79+00:00","url":"https://junglewise.ai/threats/cve-2026-57296-jenkins-external-workspace-manager-plugin-path-traversal-in"},{"cve":"CVE-2026-57301","cvss":8.8,"epss":0.0063,"slug":"cve-2026-57301-jenkins-owasp-zap-plugin-arbitrary-code-execution-on-controller","title":"Jenkins OWASP ZAP Plugin arbitrary code execution on controller","severity":"high","exploited":false,"published_at":"2026-06-24T14:17:36.23+00:00","url":"https://junglewise.ai/threats/cve-2026-57301-jenkins-owasp-zap-plugin-arbitrary-code-execution-on-controller"},{"cve":"CVE-2026-48921","cvss":7.5,"epss":0.0043,"slug":"cve-2026-48921-jenkins-pipeline-groovy-libraries-plugin-arbitrary-file-read-via","title":"Jenkins Pipeline: Groovy Libraries Plugin arbitrary file read via symbolic links","severity":"high","exploited":false,"published_at":"2026-05-27T15:16:31.747+00:00","url":"https://junglewise.ai/threats/cve-2026-48921-jenkins-pipeline-groovy-libraries-plugin-arbitrary-file-read-via"},{"cve":"CVE-2026-57303","cvss":7.1,"epss":0.0036,"slug":"cve-2026-57303-jenkins-assembla-plugin-xxe-in-xml-parser","title":"Jenkins Assembla Plugin XXE in XML parser","severity":"high","exploited":false,"published_at":"2026-06-24T14:17:36.407+00:00","url":"https://junglewise.ai/threats/cve-2026-57303-jenkins-assembla-plugin-xxe-in-xml-parser"},{"cve":"CVE-2026-48916","cvss":6.6,"epss":0.0037,"slug":"cve-2026-48916-jenkins-ldap-plugin-remote-code-execution-via-ldap-referrals","title":"Jenkins LDAP Plugin Remote Code Execution via LDAP Referrals","severity":"medium","exploited":false,"published_at":"2026-05-27T15:16:31.233+00:00","url":"https://junglewise.ai/threats/cve-2026-48916-jenkins-ldap-plugin-remote-code-execution-via-ldap-referrals"},{"cve":"CVE-2026-57304","cvss":5.4,"epss":0.0025,"slug":"cve-2026-57304-jenkins-assembla-plugin-missing-permission-check-in-connection","title":"Jenkins Assembla Plugin missing permission check in connection endpoint","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:36.497+00:00","url":"https://junglewise.ai/threats/cve-2026-57304-jenkins-assembla-plugin-missing-permission-check-in-connection"},{"cve":"CVE-2026-57294","cvss":5.4,"epss":0.0025,"slug":"cve-2026-57294-jenkins-ec2-fleet-plugin-missing-permission-check-in-aws","title":"Jenkins EC2 Fleet Plugin missing permission check in AWS credential handling","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:35.613+00:00","url":"https://junglewise.ai/threats/cve-2026-57294-jenkins-ec2-fleet-plugin-missing-permission-check-in-aws"},{"cve":"CVE-2026-57291","cvss":5.4,"epss":0.0023,"slug":"cve-2026-57291-jenkins-gitee-plugin-missing-permission-check-in-connection","title":"Jenkins Gitee Plugin missing permission check in connection endpoint","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:35.347+00:00","url":"https://junglewise.ai/threats/cve-2026-57291-jenkins-gitee-plugin-missing-permission-check-in-connection"},{"cve":"CVE-2026-57305","cvss":5.4,"epss":0.0022,"slug":"cve-2026-57305-jenkins-assembla-plugin-csrf-in-connection-endpoint","title":"Jenkins Assembla Plugin CSRF in connection endpoint","severity":"medium","exploited":false,"published_at":"2026-06-24T14:17:36.593+00:00","url":"https://junglewise.ai/threats/cve-2026-57305-jenkins-assembla-plugin-csrf-in-connection-endpoint"}],"generated_at":"2026-09-26T15:07:00.181821+00:00","technologies":[{"name":"Jenkins Project Assembla Plugin","slug":"assembla-plugin","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/assembla-plugin"},{"name":"Jenkins Project Contrast Continuous Application Security Plugin","slug":"contrast-continuous-application-security-plugin","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/contrast-continuous-application-security-plugin"},{"name":"Jenkins Project Gitee Plugin","slug":"gitee-plugin","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/gitee-plugin"}]}