Apache Software Foundation Apache Jackrabbit

• CVE-2026-92415 Medium 6.9 Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies 0.5%
• CVE-2026-92414 Critical 9.3 Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens 0.7%
• CVE-2025-53689 High 8.8 Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons 0.5%