Apache Jackrabbit

Search everything

Mentions · 7d0
Mentions · 30d2
All mentions2
First seenOct 7, 2026
Last mentioned23d ago

Timeline

2 articles · newest first

CVE-2026-92415: Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

Apache Jackrabbit DavEx clients can load attacker-chosen classes from malicious WebDAV error bodies (CVE-2026-92415).

oss-securityOct 7, 15:31 UTC · 23d agoVulnerability 2 sourcesCVE-2026-924152 · 1 read

CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

CVE-2026-92414 lets unauthenticated attackers hijack cached Apache Jackrabbit WebDAV sessions and is rated CVSS 9.3.

oss-securityupdated Oct 7, 15:31 UTC · 23d agofirst Oct 7, 15:10 UTC · 23d agoVulnerability 2 sourcesCVE-2026-924143

Related CVEs

by mentions

CVE-2026-924149.3
Session fixation in Apache Jackrabbit WebDAV
published 23d agoApache Software Foundation Apache Jackrabbit
CVE-2026-924156.9
Unsafe class selection in Apache Jackrabbit DavEx client
published 23d agoApache Software Foundation Apache Jackrabbit (jackrabbit-spi2dav, including use through jackrabbit-jcr2dav)

Appears with

Apache Software Foundationorganization · 1
Apachevendor · 1
Apache Software Foundationvendor · 1

Entities are extracted by the model from each article. First seen Oct 7, 2026, last mentioned 23d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.