Jenkins Job Import vulnerabilities

5 CVEs affecting Jenkins Job Import, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-48926, published 2026-05-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-1003015, published 2019-02-06. Critical severity, CVSS 9.1. EPSS: 1.8% chance of exploitation in the next 30 days. An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers…
CVE-2019-1003016, published 2019-02-06. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java,…
CVE-2022-43413, published 2022-10-19. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Job Import Plugin 3.5 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored…
CVE-2019-1003017, published 2019-02-06. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance,…
CVE-2026-48926, published 2026-05-27. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of…