org.apache.jackrabbit/jackrabbit-core vulnerabilities

Latest org.apache.jackrabbit/jackrabbit-core CVEs

Newest publication first

1. CVE-2025-58782 Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory

   Published 2025-09-08

   Medium·CVSS 6.5 EPSS 1.4%

   Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR l...

2. CVE-2025-53689 Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons

   Published 2025-07-14

   High·CVSS 8.8 EPSS 0.54%

   Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions)...

3. CVE-2015-1833 Improper Input Validation in Apache Jackrabbit

   Published 2015-05-29

   Medium·CVSS 6.4 EPSS 55.9% Public exploit

   XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.