Yep. Not long ago a remote code execution hole in Java was found. Fortunately Jenkins was quickly patched: https://jenkins-ci.org/content/mitigating-unauthenticated-re...