Apache Software Foundation Apache Commons BCEL

• CVE-2026-105111 Medium 4.7 Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS 0.2%
• CVE-2026-94114 Medium 5.9 Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning 0.3%
• CVE-2022-42920 Unrated Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing 3.5%