Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,072
Reset filtersJenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE
Jenkins Gitee Plugin missing permission checks
Jenkins Gitee Plugin has a cross-site request forgery vulnerability
Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation
Jenkins Priority Sorter Plugin has a CSRF vulnerability
Jenkins External Workspace Manager Plugin has a path traversal vulnerability
Jenkins Contrast Continuous Application Security Plugin has a missing permission check
Jenkins EC2 Fleet Plugin has a missing permission check
Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability
Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs
Jenkins Active Directory Plugin has an LDAP injection vulnerability
Jenkins Git client Plugin has an OS command injection vulnerability on agents
Jenkins Script Security Plugin has a script security bypass vulnerability
Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs
Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types
Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names
Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations
Jenkins Script Security Plugin sandbox bypass vulnerability
Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability
OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation
Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist
jackson-databind has @JsonView bypass for setterless creator properties
jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.