JasperReports Server vulnerabilities

3 known vulnerabilities in JasperReports Server from Jaspersoft. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.3 Critical severity

  JasperReports Server: Improper Restriction of XML External Entity Reference

  CVE-2026-16626Aug 10, 2026Jaspersoft

  Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server. This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10.

• 8.7 High severity

  JasperReports Library Community Edition: Deserialization of Untrusted Data

  CVE-2026-6009May 19, 2026Jaspersoft

  Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected system

• 9.8 Critical severity

  JasperReports Library Community Edition: Deserialization of Untrusted Data

  CVE-2025-10492Sep 16, 2025Jaspersoft

  A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library