Jenkins is a control plane, so a flaw in core or a plugin can reach past one job and touch the controller itself. Here the dangerous part is not the number of CVEs. It is that attacker-controlled workspace content can be turned into controller-side secret disclosure, SSRF, or other privileged actions, and patching only the visible plugin does not close that path if the controller still trusts the same content.
Jenkins disclosed 22 vulnerabilities across core and official plugins, including CVE-2026-70448, an XXE issue that can let workspace content make the controller read data it should not or send requests to internal resources. The affected range includes Jenkins weekly up to 2.575 and LTS up to 2.568.1, plus plugins such as AWS CodeBuild, CodeSonar, External Workspace Manager, HCL AppScan, Horreum, Ivy Report, Multijob, Parameterized Remote Trigger, Qualys Container Scanning Connector, Sauce OnDemand, SCM-Manager, Summary Display, Violation Comments to GitLab, Webhook Secret Credentials Provider, and XML Job to Job DSL.
Some fixes were not yet available at publication for several plugins, so this is not a clean one-step update story. The remaining exposure is a mixed patch state across the controller and plugins, which keeps the control-plane trust problem open until the whole set is addressed.