Apache Ivy
4 CVEs affecting Apache Ivy. Latest disclosed: 2026-07-15. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-37865 | Critical | 9.1 | 2022-11-07 | With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging… |
CVE-2022-46751 | High | 8.2 | 2023-08-21 | Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This is… |
CVE-2022-37866 | High | 7.5 | 2022-11-07 | When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders… |
CVE-2026-26032 | Medium | 5.4 | 2026-07-15 | The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is… |