Jackrabbit
Vendor:
First CVE: Jan 21, 2009 · Active for 17 years
6
Total CVEs
More Total CVEs than 80% of tracked products
1.2
Avg CVEs / Year
Higher CVE frequency than 55% of tracked products
7.4
Avg CVSS
Higher Avg CVSS than 49% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Jackrabbit over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jan 21, 2009
17 years ago
Most Recent CVE
Sep 8, 2025
319 days ago
CVE Severity & Scoring
Jackrabbit6 CVEs
50%
33%
17%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network4 (66.7%)
Unknown2 (33.3%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low4 (66.7%)
High0 (0.0%)
Unknown2 (33.3%)
User Interaction
None3 (50.0%)
Unknown2 (33.3%)
Required1 (16.7%)
Privileges Required
Low1 (16.7%)
High0 (0.0%)
None3 (50.0%)
Unknown2 (33.3%)
Top CVEs
Signals from CVEs in this product scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2015-1833MEDIUM XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 | May 29, 2015 | 6.4 | 56 | NO | YES |
CVE-2009-0026MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) searc | Jan 21, 2009 | 4.3 | 32 | NO | YES |
CVE-2023-37895CRITICAL Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch | Jul 25, 2023 | 9.8 | 30 | NO | NO |
CVE-2016-6801HIGH Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, | Sep 21, 2016 | 8.8 | 29 | NO | NO |
CVE-2025-58782MEDIUM Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.
This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; | Sep 8, 2025 | 6.5 | 26 | NO | NO |
CVE-2025-53689HIGH Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.
Users are rec | Jul 14, 2025 | 8.8 | 26 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (6 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
2 CVEs
33.3% of CVEs· 90th percentile
Social Chatter
Signals from CVEs in this product scope (6 CVEs).
Media Mentions
Signals from CVEs in this product scope (6 CVEs).
Top CNAs Publishing CVEs For Jackrabbit
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2.8.2 | 1 | 8.8 | 2.3% | 0 | 0 |
| 2.8.1 | 1 | 8.8 | 2.3% | 0 | 0 |
| 2.8.0 | 2 | 7.6 | 26.9% | 0 | 1 |
| 2.6.5 | 2 | 7.6 | 26.9% | 0 | 1 |
| 2.6.4 | 2 | 7.6 | 26.9% | 0 | 1 |
| 2.6.3 | 2 | 7.6 | 26.9% | 0 | 1 |
| 2.6.2 | 2 | 7.6 | 26.9% | 0 | 1 |
| 2.6.1 | 2 | 7.6 | 26.9% | 0 | 1 |
| 2.6.0 | 2 | 7.6 | 26.9% | 0 | 1 |
| 2.4.5 | 2 | 7.6 | 26.9% | 0 | 1 |
| 2.4.4 | 2 | 7.6 | 26.9% | 0 | 1 |
| 2.4.3 | 2 | 7.6 | 26.9% | 0 | 1 |
| 2.4.2 | 2 | 7.6 | 26.9% | 0 | 1 |
| 2.4.1 | 2 | 7.6 | 26.9% | 0 | 1 |
| 2.4.0 | 2 | 7.6 | 26.9% | 0 | 1 |
| 2.2.9 | 1 | 6.4 | 51.5% | 0 | 1 |
| 2.2.8 | 1 | 6.4 | 51.5% | 0 | 1 |
| 2.2.7 | 1 | 6.4 | 51.5% | 0 | 1 |
| 2.2.5 | 1 | 6.4 | 51.5% | 0 | 1 |
| 2.2.4 | 1 | 6.4 | 51.5% | 0 | 1 |