Jenkins Project Jenkins OWASP Dependency-Check Plugin

• CVE-2026-92136 High 8.0 Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability explo 0.4%
• CVE-2024-28153 High 7.3 Jenkins OWASP Dependency-Check Plugin 5.4.5 and earlier does not escape vulnerability metadata from Dependency-Check reports, resulting in a stored cross-site scripting (XSS) vulnerability. 0.7%
• CVE-2021-43577 Unrated Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. 1.0%