JFree maintains a narrowly scoped but strategically placed charting library, JFreeChart, that is embedded across Java applications and business intelligence platforms where its rendering and data-processing logic sits on a high-trust boundary. Vulnerabilities affecting the vendor skew toward serious outcomes and frequently acquire public exploit tooling; the recurring weakness classes—including cross-site scripting in chart rendering, out-of-bounds reads, buffer overflows, and null-pointer dereferences—reflect the memory-handling and untrusted-data parsing demands of a graphics library positioned to process external datasets. Live severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Jfree over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-52070HIGH JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the 'setSeriesNeedle(int index, int type)' method. NOTE: this is disputed by multiple third parties w | Apr 10, 2024 | 8.4 | 25 | NO | NO |
CVE-2024-22949CRITICAL JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /chart/annotations/CategoryLineAnnotation. NOTE: this is disputed by multiple third parties who | Apr 8, 2024 | 9.1 | 24 | NO | NO |
CVE-2024-23077HIGH JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the component /chart/plot/CompassPlot.java. NOTE: this is disputed by multiple third parties who beli | Apr 10, 2024 | 7.5 | 23 | NO | NO |
CVE-2007-6307MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in clickstats.php in wwwstats 3.21 allow remote attackers to inject arbitrary web script or HTML via (1) the link parameter or ( | Dec 11, 2007 | 4.3 | 22 | NO | YES |
CVE-2024-23076HIGH JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /labels/BubbleXYItemLabelGenerator.java. NOTE: this is disputed by multiple third parties who b | Apr 10, 2024 | 7.5 | 21 | NO | NO |
CVE-2007-6306MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart nam | Dec 11, 2007 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Jfree.
Media articles that mention a CVE ID that affects a product developed by Jfree — matched by CVE ID, not by vendor name.