OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-92136

HIGH · CVSS 8 EPSS 0.41% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-16 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

The Jenkins OWASP Dependency-Check Plugin versions 5.6.4 and earlier are vulnerable to a stored cross-site scripting (XSS) attack due to improper escaping of CWE values in Dependency-Check reports displayed on the Jenkins UI. This vulnerability can be exploited by users with Item/Configure permissions, potentially allowing attackers to execute arbitrary scripts in the context of other users. Organizations using this plugin should prioritize remediation to mitigate the risk of XSS attacks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-92136
Severity
HIGH
CVSS
8
EPSS
0.41%
Jenkins

Original NVD Description

Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.