Apache Ivy (Apache Software Foundation) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-07-15. Vendor: Apache Software Foundation.

CVEs of Apache Ivy

• CVE-2026-26032 - CVSS 5.4 (medium), 2026-07-15: The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging…
• CVE-2022-46751 - CVSS 8.2 (high), 2023-08-21: Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This…
• CVE-2022-37866 - CVSS 7.5 (high), 2022-11-07: When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders…
• CVE-2022-37865 - CVSS 9.1 (critical), 2022-11-07: With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip…