Apache Software Foundation Jackrabbit vulnerabilities

• apache jackrabbit Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies CVE-2026-92415 6.9 MediumOctober 7, 2026
• apache jackrabbit Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens CVE-2026-92414 9.3 CriticalOctober 7, 2026
• apache jackrabbit, apache software foundation jackrabbit core, jackrabbit jcr commons +2 more Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory CVE-2025-58782 Fix available 6.5 MediumSeptember 8, 2025
• apache jackrabbit Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons CVE-2025-53689 Fix available 8.8 HighJuly 14, 2025
• apache jackrabbit, apache software foundation jackrabbit standalone (jackrabbit-standalone and jackrabbit-standalone-components), jackrabbit webapp (jackrabbit-webapp) +2 more Apache Jackrabbit RMI access can lead to RCE CVE-2023-37895 Fix available 9.8 CriticalJuly 25, 2023
• apache jackrabbit oak Improper Removal of Sensitive Information Before Storage or Transfer in Apache Jackrabbit Oak CVE-2020-1940 Fix available 7.5 HighJanuary 28, 2020