CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 30, 2026, 3:23 AM ET)

What this means for you

This week: 3,356 CVEs published, 231 critical, and 2 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,356; Show in the list
Critical, last 7 days: 231; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,764; Show in the list

Showing CVEs that name the product jenkins:jenkins. Show all products

36 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-84657	Medium 4.2	In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allow… Assigned by jenkins	Sep 2, 2026
CVE-2026-84656	Medium 4.3	A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they h… Assigned by jenkins	Sep 2, 2026
CVE-2026-84655	Medium 4.3	Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to… Assigned by jenkins	Sep 2, 2026
CVE-2026-84653	Low 3.5	Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with O… Assigned by jenkins	Sep 2, 2026
CVE-2026-84652	High 7.3	In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the s… Assigned by jenkins	Sep 2, 2026
CVE-2026-84651	Medium 6.3	In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by s… Assigned by jenkins	Sep 2, 2026
CVE-2026-84650	High 8.8	In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of trans… Assigned by jenkins	Sep 2, 2026
CVE-2026-84648	High 8.8	In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site scripting (XSS) vulner… Assigned by jenkins	Sep 2, 2026
CVE-2026-84646	Medium 4.3	In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user… Assigned by jenkins	Sep 2, 2026
CVE-2026-84645	High 8.8	In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the global configuration… Assigned by jenkins	Sep 2, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.