What’s Vulnerable › Vulnerabilities

CVE-2025-64134

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-29 · updated 2026-10-08
• Weakness: CWE-611

Description

Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

• Jenkins Project Jenkins JDepend Plugin: through 1.3.1

References

• https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-2936
• http://www.openwall.com/lists/oss-security/2025/10/29/2

Get alerted when CVE-2025-64134 or the next vulnerability affects your stack