Is org.jenkins-ci.main:jenkins-core safe ? org.jenkins-ci.main:jenkins-core (maven) has 204 known vulnerabilities, the worst rated CRITICAL. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 0 direct dependencies
none carry a known advisory
0 packages depend on it
dependents not yet indexed for this ecosystem
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 100th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-6f9g-cxwr-q5jr, the advisory selected below
// 204 advisories GHSA-6f9g-cxwr-q5jr Jenkins has a built-in command line interface (CLI) to access Jenkins from a script or shell environment. KEV CRIT GHSA-58xm-mxjf-254g The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. CRIT GHSA-2c79-h2h5-g3fw The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. CRIT GHSA-cvvm-4cr9-r436 The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. CRIT GHSA-cv2w-q8c3-xjv7 Agents are allowed some limited access to files on the Jenkins controller file system. CRIT GHSA-8xg4-xq2v-v6j7 The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. CRIT GHSA-j3cq-h6vh-gx7f The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. CRIT GHSA-m9hr-259f-2v23 The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. CRIT GHSA-pgj6-jmj5-wqfx The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. CRIT GHSA-4g38-hrm4-rg94 The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. CRIT Show all 204 advisories Jenkins has a built-in command line interface (CLI) to access Jenkins from a script or shell environment.
Full advisory text at GitHub advisory or NVD .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Exploit maturity H // questions Is org.jenkins-ci.main:jenkins-core safe to install? CyberXYZ does not call a package safe in absolute terms. It records 204 known vulnerabilities for org.jenkins-ci.main:jenkins-core (maven), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does org.jenkins-ci.main:jenkins-core have known vulnerabilities? Yes. CyberXYZ records 204 known vulnerabilities for org.jenkins-ci.main:jenkins-core (maven), the worst rated CRITICAL. These include GHSA-6f9g-cxwr-q5jr, GHSA-58xm-mxjf-254g, GHSA-2c79-h2h5-g3fw, GHSA-cvvm-4cr9-r436, GHSA-cv2w-q8c3-xjv7.
How do I check org.jenkins-ci.main:jenkins-core before installing? Search org.jenkins-ci.main:jenkins-core in CyberXYZ Check at https://cyberxyz.io/check?q=org.jenkins-ci.main%3Ajenkins-core . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 15:08 UTC. The most recent advisory here was published 2026-06-10. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page