15 entries matching jenkins — updated 2026-11-04 · vulnfeed
| CVE / ID | Title | Severity | CVSS | EPSS | Source | Date |
|---|---|---|---|---|---|---|
| CVE-2026-117612 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by th | HIGH | 8.8 | 35%ile | NVD | 2026-10-28 |
| CVE-2026-117614 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launc | HIGH | 8.8 | 38%ile | NVD | 2026-10-28 |
| CVE-2026-117616 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validatin | HIGH | 8.8 | 49%ile | NVD | 2026-10-28 |
| CVE-2026-117620 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in | HIGH | 8.8 | 32%ile | NVD | 2026-10-28 |
| CVE-2026-117624 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing object | HIGH | 8.8 | 33%ile | NVD | 2026-10-28 |
| CVE-2026-117617 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only befor | HIGH | 8.1 | 41%ile | NVD | 2026-10-28 |
| CVE-2026-117618 | In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not ch | HIGH | 8.1 | 18%ile | NVD | 2026-10-28 |
| CVE-2026-117619 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, includ | HIGH | 8.1 | 28%ile | NVD | 2026-10-28 |
| CVE-2026-117615 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being re | MEDIUM | 6.5 | 37%ile | NVD | 2026-10-28 |
| CVE-2026-117621 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace brow | MEDIUM | 6.1 | 22%ile | NVD | 2026-10-28 |
| CVE-2026-117622 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpRespons | MEDIUM | 6.1 | 22%ile | NVD | 2026-10-28 |
| CVE-2026-117613 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, al | MEDIUM | 5.4 | 22%ile | NVD | 2026-10-28 |
| CVE-2026-117623 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar over | MEDIUM | 5.4 | 19%ile | NVD | 2026-10-28 |
| CVE-2026-117625 | A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read perm | UNKNOWN | — | 6%ile | NVD | 2026-10-28 |
| CVE-2026-117626 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the fil | UNKNOWN | — | 6%ile | NVD | 2026-10-28 |