CVE-2026-84677

The Jenkins update-center2 tool (versions 3.18.3 and earlier ) contains a stored cross-site scripting (XSS) vulnerability. The issue occurs because the tool fails to escape plugin-provided values, such as plugin names, descriptions, and version metadata , when rendering plugin download index page...