https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T23:46:12.732907+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-260060 EUVD-2026-260060 2026-10-03T23:46:12.846947+00:00 EUVD-2026-260060 https://cve.radiocsirt.org/vuln/fkie_cve-2025-58782 fkie_cve-2025-58782 2026-10-03T23:46:12.846989+00:00

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.

This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.

Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

 https://cve.radiocsirt.org/vuln/ghsa-cxvc-g8f2-4gmm GHSA-cxvc-g8f2-4gmm — Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data 2026-10-03T23:46:12.847029+00:00

Affected: Maven: org.apache.jackrabbit:jackrabbit-core, Maven: org.apache.jackrabbit:jackrabbit-jcr-commons

There is a serialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.

This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.

Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-58782 UBUNTU-CVE-2025-58782 2026-10-03T23:46:12.847062+00:00

Affected: Ubuntu:14.04:LTS: jackrabbit, Ubuntu:16.04:LTS: jackrabbit, Ubuntu:18.04:LTS: jackrabbit, Ubuntu:20.04:LTS: jackrabbit, Ubuntu:22.04:LTS: jackrabbit, Ubuntu:24.04:LTS: jackrabbit, Ubuntu:25.10: jackrabbit, Ubuntu:26.04:LTS: jackrabbit

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1986 WID-SEC-W-2025-1986 — Apache Jackrabbit: Schwachstelle ermöglicht Codeausführung 2026-10-03T23:46:12.847098+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Jackrabbit ausnutzen, um beliebigen Programmcode auszuführen.