Jasperreports Server CVEs and Security Vulnerabilities

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

CVE-2026-16626

JasperReports Server: XXE Injection Vulnerability (Unauthenticated)

Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server. This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jaspersoft

Products

Jasperreports Server

CVE-2026-6009

Jaspersoft Library Deserialisation Vulnerability

Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected system

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Jaspersoft

Products

Jasperreports Io At-scale Jasperreports Io Professional Jasperreports Library Community Edition and 5 more

CVE-2025-10492

Jaspersoft Library Deserialisation Vulnerability

A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Cloud Jaspersoft

Products

Jasperreports Io Jasperreports Library Jasperreports Server and 3 more

Page 1 of 1.