Jaspersoft JasperReports Server vulnerabilities

Latest Jaspersoft JasperReports Server CVEs

Newest publication first

1. CVE-2026-16626 JasperReports Server: XXE Injection Vulnerability (Unauthenticated)

   Published 2026-08-10

   Critical·CVSS 9.3 EPSS 0.45%

   Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server. This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10.

2. CVE-2026-6009 Jaspersoft Library Deserialisation Vulnerability

   Published 2026-05-19

   High·CVSS 8.7 EPSS 0.52%

   Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected system

3. CVE-2025-10492 Jaspersoft Library Deserialisation Vulnerability

   Published 2025-09-16

   High·CVSS 8.7 EPSS 0.92%

   A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.