Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 00:18:34 +0000 CVE-2026-92415 — Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies https://vulnerability.circl.lu/vuln/cve-2026-92415 <p><strong>Affected:</strong> Apache Software Foundation Apache Jackrabbit</p> <p>— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit&#39;s WebDAV/Davex client.</p> <p>A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation.</p> <p>Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected.</p> <p>Category: unsafe reflection on wire data (HIGH).</p> <p>This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.</p> <p>Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Jackrabbit</p> <p>— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit&#39;s WebDAV/Davex client.</p> <p>A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation.</p> <p>Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected.</p> <p>Category: unsafe reflection on wire data (HIGH).</p> <p>This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17.</p> <p>Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.</p> https://vulnerability.circl.lu/vuln/cve-2026-92415