Home / CVEs
Exploited vulnerabilities (CISA KEV)
CVEs with exploitation confirmed by CISA (Known Exploited Vulnerabilities), with required actions and deadlines.
CVE-2024-23897
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-22 Jan 24, 2024
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
CVE-2019-1003030
Critical · 9.9
KEV Urgent · 78 Public exploit CWE-693 Mar 8, 2019
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
CVE-2019-1003029
Critical · 9.9
KEV Urgent · 72 Public exploit Mar 8, 2019
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.