Jenkins project vendor intelligence
Jenkins project Known Exploited Vulnerabilities
Track evidence-backed exploitation affecting Jenkins project products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.
- Total KEVs
- 5
- Known exploited vulnerabilities affecting Jenkins project products
- In CISA KEV
- 3
- Records also listed in the official catalog
- Beyond CISA KEV
- 2
- Additional exploited CVEs absent from CISA KEV
- Sensor Observed
- 0
- Jenkins project KEVs with sensor-observed exploitation activity
The catalog gap matters for Jenkins project exposure
Two of the five exploited Jenkins project CVEs tracked here are not in CISA KEV. Teams relying on the official catalog alone would miss 40% of this vendor portfolio.
- 60%
- Covered by CISA
- 40%
- Beyond CISA
- 3
- Product families
Attested Jenkins project CVEs
Search the exploited-vulnerability portfolio, then narrow it to official CISA coverage or the additional records KEV Intelligence tracks beyond the catalog.
How exploitation is verified| CVE / description | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2026-53435
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins... |
Jenkins | High | Beyond CISA | 15 Jun 2026 |
|
CVE-2025-59474
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users... |
Jenkins | High | Beyond CISA | 26 Oct 2025 |
|
CVE-2019-1003030
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml,... |
Jenkins Pipeline: Groovy Plugin | Confirmed | In CISA | 25 Mar 2022 |
|
CVE-2019-1003029
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in... |
Jenkins Script Security Plugin | Confirmed | In CISA | 25 Apr 2022 |
|
CVE-2024-23897
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by... |
Jenkins | Confirmed | In CISA | 19 Aug 2024 |
No Jenkins project CVEs match this search or filter.
Showing 5 of 5 Jenkins project known exploited vulnerabilities.
Recurring weakness patterns
Path traversal: 'dir/../../filename', deserialization, and protection mechanism failure account for three mapped occurrences across this Jenkins project KEV portfolio.
Early warning alerts
Get alerts on high-impact exploitation
Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.