High severity8.0NVD Advisory· Published Sep 16, 2026· Updated Sep 18, 2026
CVE-2026-92136
CVE-2026-92136
Description
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=5.6.4
Patches
Vulnerability mechanics
References
1News mentions
2- Jenkins Plugins: 20 Vulnerabilities Disclosed, Script Security Plugin at High RiskVypr Intelligence · Sep 16, 2026
- Jenkins Security Advisory 2026-09-16Jenkins Security Advisories · Sep 16, 2026