LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
vendor

Jenkins

12 CVEs published in the last four months and 1 stories. Exploited flaws first.

Critical0
High10
Medium2
Exploited (KEV)0

All recent CVEs

CVECVSSSeverityProductSummaryPublished
CVE-2026-573018.8highofficial owasp zapJenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the ass119d ago
CVE-2026-572808.8highscript securityJenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied t119d ago
CVE-2026-534358.8highjenkinsIn Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize ar133d ago
CVE-2026-330018.8highjenkinsJenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of 217d ago
CVE-2026-489208.8highemail extensionJenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content 147d ago
CVE-2026-330027.5highjenkinsJenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin val217d ago
CVE-2026-489217.5highpipeline\Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in sh147d ago
CVE-2026-489227.5highcredentials bindingJenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file a147d ago
CVE-2026-572817.5highscript securityJenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotation119d ago
CVE-2026-573037.1highassemblaJenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) att119d ago
CVE-2026-330034.3mediumloadninjaJenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenk217d ago
CVE-2026-330044.3mediumloadninjaJenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form,217d ago

Filter the full tracker by Jenkins →

Our coverage of Jenkins

awshigh

From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach

A sophisticated supply chain attack, dubbed Shai Hulud, has been observed leveraging poisoned software dependencies to infiltrate CI/CD pipelines and subsequently gain access to sensitive cloud data, including information stored in Amazon Redshift. The campaign, attributed to a group known as TeamPCP, has been active since late 2025, targeting popular package repositories like npm and PyPI.