CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 6:23 PM ET)

What this means for you

This week: 3,241 CVEs published, 235 critical, and 5 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,241; Show in the list
Critical, last 7 days: 235; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product jenkins_project:jenkins. Show all products

51 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-117626	Not yet scored	Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers wit… Assigned by jenkins	Oct 28, 2026
CVE-2026-117625	Not yet scored	A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the con… Assigned by jenkins	Oct 28, 2026
CVE-2026-117624	Not yet scored	Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level confi… Assigned by jenkins	Oct 28, 2026
CVE-2026-117623	Not yet scored	Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerabili… Assigned by jenkins	Oct 28, 2026
CVE-2026-117622	Not yet scored	Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulner… Assigned by jenkins	Oct 28, 2026
CVE-2026-117621	Not yet scored	Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vuln… Assigned by jenkins	Oct 28, 2026
CVE-2026-117620	Not yet scored	Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject… Assigned by jenkins	Oct 28, 2026
CVE-2026-117619	Not yet scored	Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who… Assigned by jenkins	Oct 28, 2026
CVE-2026-117618	Not yet scored	In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition… Assigned by jenkins	Oct 28, 2026
CVE-2026-117617	Not yet scored	Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allow… Assigned by jenkins	Oct 28, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.