High · 8.0 CVE-2026-92136 EUVD-2026-80760GHSA-5xjp-hc9r-qrrp

Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulti…

Published Sep 16, 2026 · Updated Sep 16, 2026 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins OWASP Dependency-Check Plugin Category: Web / CMS

Description

Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected products

Vendor	Product	Affected	Fixed
Jenkins Project	Jenkins OWASP Dependency-Check Plugin	≤ 5.6.4	—

Advisories 1

WID-SEC-2026-3428 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026

References

Jenkins Security Advisory 2026-09-16 vendor-advisory