Jaspersoft CVEs and Security Vulnerabilities

CVE-2026-16626

JasperReports Server: XXE Injection Vulnerability (Unauthenticated)

Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server. This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jaspersoft

Products

Jasperreports Server

CVE-2026-6009

Jaspersoft Library Deserialisation Vulnerability

Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected system

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Jaspersoft

Products

Jasperreports Io At-scale Jasperreports Io Professional Jasperreports Library Community Edition and 5 more

CVE-2025-10492

Jaspersoft Library Deserialisation Vulnerability

A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Cloud Jaspersoft

Products

Jasperreports Io Jasperreports Library Jasperreports Server and 3 more

CVE-2017-14941

jasperreports: Cleartext storage of passwords

Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source passwords by accessing flow.html and reading the HTML source code of the page reached in an Edit action for a Data Source connector.

CVSS 3.0 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Jaspersoft

Products

Jasperreports

Search vulnerabilities

JasperReports Server: XXE Injection Vulnerability (Unauthenticated)

Jaspersoft Library Deserialisation Vulnerability

Jaspersoft Library Deserialisation Vulnerability

jasperreports: Cleartext storage of passwords