CloudBees CloudBees Continuous Delivery powered by Jenkins

  1. Vendors
  2. CloudBees

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any CloudBees product.

RSS Feeds for CloudBees security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in CloudBees products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by CloudBees Sorted by Most Security Vulnerabilities since 2018

CloudBees Jenkins9 vulnerabilities

CloudBees Jenkins Operations Center1 vulnerability

By the Year

In 2026 there have been 0 vulnerabilities in CloudBees. Last year, in 2025 CloudBees had 1 security vulnerability published. Right now, CloudBees is on track to have less security vulnerabilities in 2026 than it did last year.




Year Vulnerabilities Average Score
2026 0 0.00
2025 1 7.10
2024 1 8.80
2023 2 6.40
2022 0 0.00
2021 0 0.00
2020 2 0.00
2019 1 9.80

It may take a day or so for new CloudBees vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent CloudBees Security Vulnerabilities

CVE Date Vulnerability Products
CVE-2025-64134 Oct 29, 2025
Jenkins JDepend Plugin up to 1.3.1 XXE via outdated JDepend Maven Plugin Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.
Jenkins
CVE-2024-43044 Aug 07, 2024
Jenkins ClassLoaderProxy fetchJar arbitrary file read (pre-2.470, 2.452.3) Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.
Jenkins
CVE-2023-27904 Mar 10, 2023
Jenkins 2.393 & LTS 2.375.3 - Agent Connection Break Stack Trace Disclosure Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers.
Jenkins
CVE-2023-27901 Mar 10, 2023
Jenkins DoS via Unlimited Request Parts (before 2.394, LTS 2.375.3) Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service.
Jenkins
CVE-2015-1811 Jan 15, 2020
XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document.
Jenkins
CVE-2015-1809 Jan 15, 2020
XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.
Jenkins
CVE-2019-11350 Apr 19, 2019
CloudBees Jenkins Operations Center 2.150.2.3, when an expired trial license exists CloudBees Jenkins Operations Center 2.150.2.3, when an expired trial license exists, allows Cleartext Password Storage and Retrieval via the proxy configuration page.
Jenkins Operations Center
CVE-2013-2034 May 14, 2014
Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary code or (2) initiate deployment of binaries to a Maven repository via unspecified vectors.
Jenkins
CVE-2013-2033 Apr 10, 2014
Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote authenticated users with write permission to inject arbitrary web script or HTML via unspecified vectors.
Jenkins
CVE-2012-6074 Feb 24, 2013
Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.
Jenkins
Built by Foundeo Inc., with data from the National Vulnerability Database (NVD). Privacy Policy. Use of this site is governed by the Legal Terms
Disclaimer
CONTENT ON THIS WEBSITE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. Always check with your vendor for the most up to date, and accurate information.