Jaspersoft vulnerabilities

Products

• JasperReports Server 3
• JasperReports IO At-Scale 2
• JasperReports IO Professional 2
• JasperReports Library Professional 2
• JasperReports Web Studio 2
• Jaspersoft Studio Community Edition 2
• Jaspersoft Studio Professional 2
• JasperReport Servers 1
• jasperreports 1
• JasperReports Library Community Edition 1

Latest Jaspersoft CVEs

Newest publication first

1. CVE-2026-16626 JasperReports Server: XXE Injection Vulnerability (Unauthenticated)

   Published 2026-08-10

   Critical·CVSS 9.3 EPSS 0.45%

   Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server. This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10.

2. CVE-2026-6009 Jaspersoft Library Deserialisation Vulnerability

   Published 2026-05-19

   High·CVSS 8.7 EPSS 0.52%

   Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected system

3. CVE-2025-10492 Jaspersoft Library Deserialisation Vulnerability

   Published 2025-09-16

   High·CVSS 8.7 EPSS 0.92%

   A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library

4. CVE-2024-3325 JasperReports Server Driver upload vulnerability

   Published 2024-07-10

   High·CVSS 8.6 EPSS 0.59%

   Vulnerability in Jaspersoft JasperReport Servers.This issue affects JasperReport Servers: from 8.0.4 through 9.0.0.

5. CVE-2017-14941 Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source passwords by accessing flow.html and read...

   Published 2017-10-01

   Medium·CVSS 6.5 EPSS 1.0%

   Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source passwords by accessing flow.html and reading the HTML source code of the page reached in an Edit action for a Data Source...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.