VendorsApachejackrabbitany version
Vulnerabilities

Apache Jackrabbit any version

Ranked by severity, then by exploit likelihood, unless you sort otherwise. Click a CVE ID for its full record.

6CVEs
CVE-2023-37895
Apache Jackrabbit RMI access can lead to RCE
Published 2023-07-25 · Modified
9.8EPSS 0.032
CVE-2026-92414
Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
Published 2026-10-07 · Analyzed
9.3EPSS 0.007
CVE-2025-53689
Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
Published 2025-07-14 · Modified
8.8EPSS 0.005
CVE-2026-92415
Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies
Published 2026-10-07 · Analyzed
6.9EPSS 0.005
CVE-2025-58782
Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory
Published 2025-09-08 · Analyzed
6.5EPSS 0.014
CVE-2015-1833
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
Published 2015-05-29 · Modified
6.41 PoCEPSS 0.559