Apache Jackrabbit vulnerabilities

• apache jackrabbit Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies CVE-2026-92415 6.9 MediumOctober 7, 2026
• apache jackrabbit Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens CVE-2026-92414 9.3 CriticalOctober 7, 2026
• apache jackrabbit, apache software foundation jackrabbit core, jackrabbit jcr commons +2 more Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory CVE-2025-58782 Fix available 6.5 MediumSeptember 8, 2025
• apache jackrabbit Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons CVE-2025-53689 Fix available 8.8 HighJuly 14, 2025
• apache jackrabbit, apache software foundation jackrabbit standalone (jackrabbit-standalone and jackrabbit-standalone-components), jackrabbit webapp (jackrabbit-webapp) +2 more Apache Jackrabbit RMI access can lead to RCE CVE-2023-37895 Fix available 9.8 CriticalJuly 25, 2023
• apache jackrabbit oak Improper Removal of Sensitive Information Before Storage or Transfer in Apache Jackrabbit Oak CVE-2020-1940 Fix available 7.5 HighJanuary 28, 2020
• apache jackrabbit, debian linux +1 more Apache Jackrabbit Authentication Hijacking Vulnerability CVE-2016-6801 Fix available 8.8 HighSeptember 18, 2016
• apache jackrabbit Improper Input Validation in Apache Jackrabbit CVE-2015-1833 Public exploitFix available EPSS 55.9% 6.4 MediumMay 29, 2015
• apache jackrabbit Apache Jackrabbit contains Cross-site Scripting CVE-2009-0026 Public exploitFix available EPSS 26.8% 4.3 MediumJanuary 21, 2009