What’s Vulnerable › Products

Apache Software Foundation Apache Jackrabbit vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your Apache Software Foundation Apache Jackrabbit version is affected

Latest Apache Software Foundation Apache Jackrabbit vulnerabilities

• CVE-2026-92415 — Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies (CVSS 5.3)
• CVE-2026-92414 — Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens (CVSS 9.1)
• CVE-2025-58782 — Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory (CVSS 6.5)
• CVE-2025-53689 — Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons (CVSS 8.8)
• CVE-2023-37895 — Apache Jackrabbit RMI access can lead to RCE (CVSS 9.8)
• CVE-2016-6801 — (CVSS 8.8)
• CVE-2015-1833 — (CVSS 6.4)
• CVE-2009-0026 — (CVSS 4.3)