CVE-2026-92135

Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scriptin...

CVE-2026-92135

Jenkins Coverage Plugin version 3.3358.v9487dde48783 and earlier is affected by a stored cross-site scripting (XSS) vulnerability. The plugin fails to validate the coverage results ID when a job configuration is submitted via the REST API , allowing an attacker with Item/Configure permission to i...

CVE-2025-67641

Jenkins Coverage Plugin 2.3054.ve1ff7baa123b and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier ...