Batik
12 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Batik, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Batik CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 12 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High7
- Medium4
Latest CVEs
The 12 most recently published vulnerabilities affecting Batik.
- CVE-2022-44729Apache XML Graphics Batik: Information disclosure vulnerability7.1
- CVE-2022-44730Apache XML Graphics Batik: Information disclosure vulnerability4.4
- CVE-2022-42890Apache Batik prior to 1.16 allows RCE via scripting7.5
- CVE-2022-41704Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input7.5
- CVE-2022-38648PDFTranscoder does not block external resources5.3
- CVE-2022-40146Jar url should be blocked by DefaultScriptSecurity7.5
- CVE-2022-38398Server-Side Request Forgery Information Disclosure Vulnerability5.3
- CVE-2020-11987Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vul...8.2
- CVE-2019-17566Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this ...7.5
- CVE-2018-8013In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor ...9.8
- CVE-2017-5662In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown d...7.3
- CVE-2015-0250XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of serv...6.4
Product grouping is registry-driven, with AI assist and human review. How it works