CVE-2026-92136
Quick assessment
Affected
Jenkins Project Jenkins OWASP Dependency-Check Plugin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Jenkins OWASP Dependency-Check 插件 5.6.4 及更早版本未对依赖项检查报告中来自 CWE 的值进行转义，导致在 Jenkins 用户界面中产生存储型跨站脚本（XSS）漏洞。该漏洞可被拥有“Item/Configure”权限的攻击者利用。
Possible ATT&CK Techniques 3 AI
T1190 · Exploit Public-Facing Application T1557 · Adversary-in-the-Middle T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Jenkins Project | Jenkins OWASP Dependency-Check Plugin | ≤ 5.6.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92136
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Jenkins Project | Jenkins OWASP Dependency-Check Plugin | 0 ~ 5.6.4 | - |
|
II. Public POCs for CVE-2026-92136
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92136
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-92136 (1)
Same Patch Batch · Jenkins Project · 2026-09-16 · 20 CVEs total
| CVE-2026-92132 | Jenkins Gradle Plugin低版本Develocity访问密钥泄露 | |
| CVE-2026-92122 | Jenkins Script Security Plugin 1415.v9af9b3ac253d及以下版本沙箱逃逸漏洞 | |
| CVE-2026-92124 | Jenkins脚本安全插件1415.v9af9b3ac253d前存在沙箱逃逸漏洞 | |
| CVE-2026-92123 | Jenkins Script Security Plugin 低版本空值接收者沙箱绕过 | |
| CVE-2026-92125 | Jenkins Script Security插件沙箱逃逸漏洞 | |
| CVE-2026-92127 | Jenkins脚本安全插件1415及之前版本远程代码执行 | |
| CVE-2026-92126 | Jenkins Script Security插件沙箱绕过漏洞 | |
| CVE-2026-92128 | Jenkins Script Security插件1415.09af9b3ac253d及更早版本远程代码执行 | |
| CVE-2026-92130 | Jenkins Pipeline插件凭证泄露漏洞 | |
| CVE-2026-92129 | Jenkins插件1415版沙箱绕过漏洞 | |
| CVE-2026-92141 | Jenkins Keycloak插件2.4.1重定向钓鱼漏洞 | |
| CVE-2026-92131 | Groovy Libraries 805.va_fc79344957d 路径遍历漏洞 | |
| CVE-2026-92133 | Jenkins GitLab Plugin 1.2149及之前版本凭证缓存访问漏洞 | |
| CVE-2026-92134 | Jenkins Warnings 13.10258版存储型XSS漏洞 | |
| CVE-2026-92135 | Jenkins Coverage插件≤3.3358存储型XSS漏洞 | |
| CVE-2026-92137 | Jenkins Robot Framework 6.2.2前路径校验缺失致RCE | |
| CVE-2026-92138 | Jenkins Bitbucket插件≤6.0.1 OAuth令牌劫持 | |
| CVE-2026-92140 | Jenkins Gitee插件存储型XSS漏洞 | |
| CVE-2026-92139 | Jenkins Bitbucket插件4.0.1前凭证泄露 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-92136
No comments yet