GHSA-8297-V2RF-2P32 vulnerabilities

Vulnerabilities for packages: jenkins...

SUSE CVE-2017-1000362

The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINSHOME with a new key. It also created a backup directory with all old secrets, and the key used to encrypt them. These backups were world-readable and not removed afterwards. Jenkins now deletes the...

TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack

Checkmarx has confirmed that a modified version of the Jenkins AST plugin was published to the Jenkins Marketplace. "If you are using Checkmarx Jenkins AST plugin, you need to ensure that you are using the version 2.0.13-829.vc72453fa1c16 that was published on December 17, 2025 or previously," th...

Embedded Malicious Code

Overview com.checkmarx.jenkins:checkmarx-ast-scanner is a plugin that allows the user to scan their source code using Checkmarx AST platform and provide the results as a feedback. Affected versions of this package are vulnerable to Embedded Malicious Code. A version of the Checkmarx Jenkins AST...

GHSA-P334-GFHQ-C7W6 vulnerabilities

Vulnerabilities for packages: jenkins...

GHSA-JP9R-MMHW-VFF3 vulnerabilities

Vulnerabilities for packages: jenkins...

CVE-2026-42521 vulnerabilities

Vulnerabilities for packages: jenkins...

CVE-2026-42519 vulnerabilities

Vulnerabilities for packages: jenkins...

GHSA-JP9R-MMHW-VFF3 vulnerabilities

Vulnerabilities for packages: jenkins...

CVE-2026-42521 vulnerabilities

Vulnerabilities for packages: jenkins...

CVE-2026-42519 vulnerabilities

Vulnerabilities for packages: jenkins...

GHSA-P334-GFHQ-C7W6 vulnerabilities

Vulnerabilities for packages: jenkins...

The Jenkins Threat Landscape

What usage patterns, plugin adoption, and configuration choices reveal about the Jenkins attack surface...

RHCOS 3 : OpenShift Container Platform 3.11.569 (RHSA-2021:4827)

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4827 advisory. - jenkins: FilePathmkdirs does not check permission to create parent directories CVE-2021-21685 - jenkins: File path filters do not...

RHCOS 4 : OpenShift Container Platform 4.8.22 (RHSA-2021:4829)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4829 advisory. - coreos-installer: restrict access permissions on /boot/ignition,/config.ign CVE-2021-3917 - jenkins: FilePathmkdirs does not check...

RHCOS 3 : OpenShift Container Platform 3.11 (RHSA-2020:3541)

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3541 advisory. - jenkins-jira-plugin: plugin information disclosure CVE-2019-16541 - openshift-ansible: cors allowed origin allows changing url...

RHCOS 3 : OpenShift Container Platform 3.11.634 (RHSA-2022:0555)

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0555 advisory. - jenkins: no POST request is required for the endpoint handling manual build requests which could result in CSRF CVE-2022-20612 -...

RHCOS 4 : OpenShift Container Platform 4.7.43 (RHSA-2022:0491)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0491 advisory. - jenkins: no POST request is required for the endpoint handling manual build requests which could result in CSRF CVE-2022-20612 -...

RHCOS 4 : Red Hat OpenShift Container Platform 4.1 jenkins-2-plugins (RHSA-2019:2662)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:2662 advisory. - jenkins-plugin-script-security: Sandbox bypass through type casts in Script Security Plugin CVE-2019-10355 -...

RHCOS 3 : OpenShift Container Platform 3.11 jenkins-2-plugins (RHSA-2020:0964)

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0964 advisory. - openshift/jenkins-plugin: Deserialization in snakeyaml YAML objects allows for remote code execution CVE-2020-2167 Note that Nessus has not...