Jackrabbit (Apache) - vulnerabilities (CVEs)

8 CVEs, 2 in the last 30 days, 286 known versions, newest CVE from 2026-10-07. Vendor: Apache.

CVEs of Jackrabbit

• CVE-2026-92415 - CVSS 6.9 (medium), 2026-10-07: — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or…
• CVE-2026-92414 - CVSS 9.3 (critical), 2026-10-07: : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any…
• CVE-2025-58782 - CVSS 6.5 (medium), 2025-09-08: Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from…
• CVE-2025-53689 - CVSS 8.8 (high), 2025-07-14: Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load…
• CVE-2023-37895 - CVSS 9.8 (critical), 2023-07-25: Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including)…
• CVE-2016-6801 - CVSS 8.8 (high), 2016-09-21: Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before…
• CVE-2015-1833 - CVSS 6.4 (medium), 2015-05-29: XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1,…
• CVE-2009-0026 - CVSS 4.3 (medium), 2009-01-21: Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q…