io.jenkins.blueocean:blueocean (>=1.27.17, <=1.27.26), io.jenkins.blueocean:blueocean-bitbucket-pipeline (>=1.27.17, <=1.27.26) +5 more potentially affected by CVE-2026-42524 via org.jenkins-ci.plugins:htmlpublisher (1.36)

org.jenkins-ci.plugins:htmlpublisher MAVEN version 1.36 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:htmlpublisher and may be impacted: - io.jenkins.blueocean:blueocean =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.1...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9) potentially affected by CVE-2026-42524 via org.jenkins-ci.plugins:htmlpublisher (1.6)

org.jenkins-ci.plugins:htmlpublisher MAVEN version 1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:htmlpublisher and may be impacted: - com.btc.ep:btc-embeddedplatform =1.9.2-beta, =2.5.9 Source cves: CVE-2026-42524 Source...

CVE-2026-42524

Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...