{"schema_version":1,"title":"com.fasterxml.jackson.core:jackson-databind (Maven) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 25 vulnerabilities in com.fasterxml.jackson.core:jackson-databind (Maven): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-54518, was published on 23 June 2026.","url":"https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind","json_url":"https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":0,"all_time":25,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":2},"latest":[{"cve":"CVE-2026-54518","cvss":6.5,"epss":0.0035,"slug":"cve-2026-54518-fasterxml-jackson-databind-authorization-bypass-in","title":"FasterXML jackson-databind authorization bypass in UnwrappedPropertyHandler","severity":"medium","exploited":false,"published_at":"2026-06-23T22:16:32.073+00:00","url":"https://junglewise.ai/threats/cve-2026-54518-fasterxml-jackson-databind-authorization-bypass-in"},{"cve":"CVE-2026-50193","cvss":3.1,"epss":0.0062,"slug":"cve-2026-50193-fasterxml-jackson-databind-denial-of-service-via-deeply-nested","title":"FasterXML jackson-databind denial of service via deeply nested JSON","severity":"medium","exploited":false,"published_at":"2026-06-23T21:17:01.117+00:00","url":"https://junglewise.ai/threats/cve-2026-50193-fasterxml-jackson-databind-denial-of-service-via-deeply-nested"},{"cve":"CVE-2020-10650","cvss":3.1,"epss":0.0333,"slug":"cve-2020-10650-jackson-databind-vulnerable-to-unsafe-deserialization","title":"jackson-databind vulnerable to unsafe deserialization","severity":"low","exploited":false,"published_at":"2022-07-15T19:41:47+00:00","url":"https://junglewise.ai/threats/cve-2020-10650-jackson-databind-vulnerable-to-unsafe-deserialization"},{"cve":"CVE-2020-36187","cvss":3.1,"epss":0.0419,"slug":"cve-2020-36187-unsafe-deserialization-in-jackson-databind","title":"Unsafe Deserialization in jackson-databind","severity":"low","exploited":false,"published_at":"2021-12-09T19:16:51+00:00","url":"https://junglewise.ai/threats/cve-2020-36187-unsafe-deserialization-in-jackson-databind"},{"cve":"CVE-2020-36184","cvss":3.1,"epss":0.0836,"slug":"cve-2020-36184-unsafe-deserialization-in-jackson-databind","title":"Unsafe Deserialization in jackson-databind","severity":"low","exploited":false,"published_at":"2021-12-09T19:16:26+00:00","url":"https://junglewise.ai/threats/cve-2020-36184-unsafe-deserialization-in-jackson-databind"},{"cve":"CVE-2020-36185","cvss":3.1,"epss":0.0419,"slug":"cve-2020-36185-unsafe-deserialization-in-jackson-databind","title":"Unsafe Deserialization in jackson-databind","severity":"low","exploited":false,"published_at":"2021-12-09T19:16:02+00:00","url":"https://junglewise.ai/threats/cve-2020-36185-unsafe-deserialization-in-jackson-databind"},{"cve":"CVE-2020-35728","cvss":3.1,"epss":0.125,"slug":"cve-2020-35728-serialization-gadget-exploit-in-jackson-databind","title":"Serialization gadget exploit in jackson-databind","severity":"low","exploited":false,"published_at":"2021-12-09T19:15:24+00:00","url":"https://junglewise.ai/threats/cve-2020-35728-serialization-gadget-exploit-in-jackson-databind"},{"cve":"CVE-2020-35491","cvss":3.1,"epss":0.0775,"slug":"cve-2020-35491-serialization-gadgets-exploit-in-jackson-databind","title":"Serialization gadgets exploit in jackson-databind","severity":"low","exploited":false,"published_at":"2021-12-09T19:15:11+00:00","url":"https://junglewise.ai/threats/cve-2020-35491-serialization-gadgets-exploit-in-jackson-databind"},{"cve":"CVE-2020-35490","cvss":3.1,"epss":0.0629,"slug":"cve-2020-35490-serialization-gadgets-exploit-in-jackson-databind","title":"Serialization gadgets exploit in jackson-databind","severity":"low","exploited":false,"published_at":"2021-12-09T19:15:00+00:00","url":"https://junglewise.ai/threats/cve-2020-35490-serialization-gadgets-exploit-in-jackson-databind"},{"cve":"CVE-2020-24616","cvss":3.1,"epss":0.0758,"slug":"cve-2020-24616-code-injection-in-jackson-databind","title":"Code Injection in jackson-databind","severity":"low","exploited":false,"published_at":"2021-12-09T19:14:51+00:00","url":"https://junglewise.ai/threats/cve-2020-24616-code-injection-in-jackson-databind"},{"cve":"CVE-2020-36186","cvss":3.1,"epss":0.0419,"slug":"cve-2020-36186-unsafe-deserialization-in-jackson-databind","title":"Unsafe Deserialization in jackson-databind","severity":"low","exploited":false,"published_at":"2021-11-19T20:13:06+00:00","url":"https://junglewise.ai/threats/cve-2020-36186-unsafe-deserialization-in-jackson-databind"},{"cve":"CVE-2020-14061","cvss":3.1,"epss":0.0446,"slug":"cve-2020-14061-deserialization-of-untrusted-data-in-jackson-databind","title":"Deserialization of untrusted data in Jackson Databind","severity":"low","exploited":false,"published_at":"2020-06-18T14:44:50+00:00","url":"https://junglewise.ai/threats/cve-2020-14061-deserialization-of-untrusted-data-in-jackson-databind"},{"cve":"CVE-2020-14062","cvss":3.1,"epss":0.0811,"slug":"cve-2020-14062-deserialization-of-untrusted-data-in-jackson-databind","title":"Deserialization of untrusted data in Jackson Databind","severity":"low","exploited":false,"published_at":"2020-06-18T14:44:48+00:00","url":"https://junglewise.ai/threats/cve-2020-14062-deserialization-of-untrusted-data-in-jackson-databind"},{"cve":"CVE-2020-14060","cvss":3.1,"epss":0.0861,"slug":"cve-2020-14060-deserialization-of-untrusted-data-in-jackson-databind","title":"Deserialization of untrusted data in Jackson Databind","severity":"low","exploited":false,"published_at":"2020-06-18T14:44:46+00:00","url":"https://junglewise.ai/threats/cve-2020-14060-deserialization-of-untrusted-data-in-jackson-databind"},{"cve":"CVE-2020-14195","cvss":3.1,"epss":0.0455,"slug":"cve-2020-14195-deserialization-of-untrusted-data-in-jackson-databind","title":"Deserialization of untrusted data in Jackson Databind","severity":"low","exploited":false,"published_at":"2020-06-18T14:44:43+00:00","url":"https://junglewise.ai/threats/cve-2020-14195-deserialization-of-untrusted-data-in-jackson-databind"},{"cve":"CVE-2020-11112","cvss":3.1,"epss":0.0364,"slug":"cve-2020-11112-jackson-databind-mishandles-the-interaction-between-serialization","title":"jackson-databind mishandles the interaction between serialization gadgets and typing","severity":"low","exploited":false,"published_at":"2020-06-10T21:12:41+00:00","url":"https://junglewise.ai/threats/cve-2020-11112-jackson-databind-mishandles-the-interaction-between-serialization"},{"cve":"CVE-2019-14893","epss":0.0409,"slug":"cve-2019-14893-polymorphic-deserialization-of-malicious-object-in-jackson","title":"Polymorphic deserialization of malicious object in jackson-databind","severity":"info","exploited":false,"published_at":"2020-05-15T18:59:07+00:00","url":"https://junglewise.ai/threats/cve-2019-14893-polymorphic-deserialization-of-malicious-object-in-jackson"},{"cve":"CVE-2020-10968","cvss":3.1,"epss":0.0363,"slug":"cve-2020-10968-jackson-databind-mishandles-the-interaction-between-serialization","title":"jackson-databind mishandles the interaction between serialization gadgets and typing","severity":"low","exploited":false,"published_at":"2020-05-15T18:58:54+00:00","url":"https://junglewise.ai/threats/cve-2020-10968-jackson-databind-mishandles-the-interaction-between-serialization"},{"cve":"CVE-2020-11111","cvss":3.1,"epss":0.0358,"slug":"cve-2020-11111-jackson-databind-mishandles-the-interaction-between-serialization","title":"jackson-databind mishandles the interaction between serialization gadgets and typing","severity":"low","exploited":false,"published_at":"2020-05-15T18:58:50+00:00","url":"https://junglewise.ai/threats/cve-2020-11111-jackson-databind-mishandles-the-interaction-between-serialization"},{"cve":"CVE-2020-11113","cvss":3.1,"epss":0.0628,"slug":"cve-2020-11113-jackson-databind-mishandles-the-interaction-between-serialization","title":"jackson-databind mishandles the interaction between serialization gadgets and typing","severity":"low","exploited":false,"published_at":"2020-05-15T18:58:47+00:00","url":"https://junglewise.ai/threats/cve-2020-11113-jackson-databind-mishandles-the-interaction-between-serialization"},{"cve":"CVE-2020-11619","cvss":3.1,"epss":0.0371,"slug":"cve-2020-11619-jackson-databind-mishandles-the-interaction-between-serialization","title":"jackson-databind mishandles the interaction between serialization gadgets and typing","severity":"low","exploited":false,"published_at":"2020-05-15T18:58:44+00:00","url":"https://junglewise.ai/threats/cve-2020-11619-jackson-databind-mishandles-the-interaction-between-serialization"},{"cve":"CVE-2020-10969","cvss":3.1,"epss":0.0356,"slug":"cve-2020-10969-jackson-databind-mishandles-the-interaction-between-serialization","title":"jackson-databind mishandles the interaction between serialization gadgets and typing","severity":"low","exploited":false,"published_at":"2020-04-23T21:36:03+00:00","url":"https://junglewise.ai/threats/cve-2020-10969-jackson-databind-mishandles-the-interaction-between-serialization"},{"cve":"CVE-2020-9546","cvss":3.1,"epss":0.0461,"slug":"cve-2020-9546-jackson-databind-mishandles-the-interaction-between-serialization","title":"jackson-databind mishandles the interaction between serialization gadgets and typing","severity":"low","exploited":false,"published_at":"2020-04-23T21:08:40+00:00","url":"https://junglewise.ai/threats/cve-2020-9546-jackson-databind-mishandles-the-interaction-between-serialization"},{"cve":"CVE-2020-11620","cvss":3.1,"epss":0.0578,"slug":"cve-2020-11620-jackson-databind-mishandles-the-interaction-between-serialization","title":"jackson-databind mishandles the interaction between serialization gadgets and typing","severity":"low","exploited":false,"published_at":"2020-04-23T20:19:02+00:00","url":"https://junglewise.ai/threats/cve-2020-11620-jackson-databind-mishandles-the-interaction-between-serialization"},{"cve":"CVE-2020-10672","cvss":3.1,"epss":0.0306,"slug":"cve-2020-10672-jackson-databind-mishandles-the-interaction-between-serialization","title":"jackson-databind mishandles the interaction between serialization gadgets and typing","severity":"low","exploited":false,"published_at":"2020-04-23T16:32:59+00:00","url":"https://junglewise.ai/threats/cve-2020-10672-jackson-databind-mishandles-the-interaction-between-serialization"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"com.liferay.portal:release.portal.bom (Maven)","slug":"com-liferay-portal-release-portal-bom","vulnerabilities":92,"url":"https://junglewise.ai/threats/technologies/com-liferay-portal-release-portal-bom"},{"name":"org.keycloak:keycloak-services (Maven)","slug":"org-keycloak-keycloak-services","vulnerabilities":76,"url":"https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services"},{"name":"org.keycloak:keycloak-core (Maven)","slug":"org-keycloak-keycloak-core","vulnerabilities":56,"url":"https://junglewise.ai/threats/technologies/org-keycloak-keycloak-core"},{"name":"org.apache.struts:struts2-core (Maven)","slug":"org-apache-struts-struts2-core","vulnerabilities":40,"url":"https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core"},{"name":"net.mingsoft:ms-mcms (Maven)","slug":"net-mingsoft-ms-mcms","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/net-mingsoft-ms-mcms"},{"name":"com.thoughtworks.xstream:xstream (Maven)","slug":"com-thoughtworks-xstream-xstream","vulnerabilities":37,"url":"https://junglewise.ai/threats/technologies/com-thoughtworks-xstream-xstream"},{"name":"com.jfinal:jfinal (Maven)","slug":"com-jfinal-jfinal","vulnerabilities":36,"url":"https://junglewise.ai/threats/technologies/com-jfinal-jfinal"},{"name":"org.jenkins-ci.plugins:script-security (Maven)","slug":"org-jenkins-ci-plugins-script-security","vulnerabilities":36,"url":"https://junglewise.ai/threats/technologies/org-jenkins-ci-plugins-script-security"},{"name":"org.apache.tomcat:tomcat (Maven)","slug":"org-apache-tomcat-tomcat","vulnerabilities":35,"url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat"},{"name":"com.liferay.portal:release.dxp.bom (Maven)","slug":"com-liferay-portal-release-dxp-bom","vulnerabilities":34,"url":"https://junglewise.ai/threats/technologies/com-liferay-portal-release-dxp-bom"},{"name":"org.opencms:opencms-core (Maven)","slug":"org-opencms-opencms-core","vulnerabilities":31,"url":"https://junglewise.ai/threats/technologies/org-opencms-opencms-core"},{"name":"org.keycloak:keycloak-parent (Maven)","slug":"org-keycloak-keycloak-parent","vulnerabilities":26,"url":"https://junglewise.ai/threats/technologies/org-keycloak-keycloak-parent"}],"technology":{"hub":true,"name":"com.fasterxml.jackson.core:jackson-databind (Maven)","slug":"com-fasterxml-jackson-core-jackson-databind","vendor":{"name":"Maven","slug":"maven","url":"https://junglewise.ai/threats/vendors/maven"},"aliases":[],"homepage":"https://github.com/FasterXML/jackson-databind","repo_url":"https://github.com/FasterXML/jackson-databind","description":"Jackson-databind is a Java library for data-binding that provides functionality for converting between JSON and Java objects.","url":"https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind"},"most_severe":[{"cve":"CVE-2026-54518","cvss":6.5,"epss":0.0035,"slug":"cve-2026-54518-fasterxml-jackson-databind-authorization-bypass-in","title":"FasterXML jackson-databind authorization bypass in UnwrappedPropertyHandler","severity":"medium","exploited":false,"published_at":"2026-06-23T22:16:32.073+00:00","url":"https://junglewise.ai/threats/cve-2026-54518-fasterxml-jackson-databind-authorization-bypass-in"},{"cve":"CVE-2026-50193","cvss":3.1,"epss":0.0062,"slug":"cve-2026-50193-fasterxml-jackson-databind-denial-of-service-via-deeply-nested","title":"FasterXML jackson-databind denial of service via deeply nested JSON","severity":"medium","exploited":false,"published_at":"2026-06-23T21:17:01.117+00:00","url":"https://junglewise.ai/threats/cve-2026-50193-fasterxml-jackson-databind-denial-of-service-via-deeply-nested"},{"cve":"CVE-2020-35728","cvss":3.1,"epss":0.125,"slug":"cve-2020-35728-serialization-gadget-exploit-in-jackson-databind","title":"Serialization gadget exploit in jackson-databind","severity":"low","exploited":false,"published_at":"2021-12-09T19:15:24+00:00","url":"https://junglewise.ai/threats/cve-2020-35728-serialization-gadget-exploit-in-jackson-databind"},{"cve":"CVE-2020-14060","cvss":3.1,"epss":0.0861,"slug":"cve-2020-14060-deserialization-of-untrusted-data-in-jackson-databind","title":"Deserialization of untrusted data in Jackson Databind","severity":"low","exploited":false,"published_at":"2020-06-18T14:44:46+00:00","url":"https://junglewise.ai/threats/cve-2020-14060-deserialization-of-untrusted-data-in-jackson-databind"},{"cve":"CVE-2020-36184","cvss":3.1,"epss":0.0836,"slug":"cve-2020-36184-unsafe-deserialization-in-jackson-databind","title":"Unsafe Deserialization in jackson-databind","severity":"low","exploited":false,"published_at":"2021-12-09T19:16:26+00:00","url":"https://junglewise.ai/threats/cve-2020-36184-unsafe-deserialization-in-jackson-databind"},{"cve":"CVE-2020-14062","cvss":3.1,"epss":0.0811,"slug":"cve-2020-14062-deserialization-of-untrusted-data-in-jackson-databind","title":"Deserialization of untrusted data in Jackson Databind","severity":"low","exploited":false,"published_at":"2020-06-18T14:44:48+00:00","url":"https://junglewise.ai/threats/cve-2020-14062-deserialization-of-untrusted-data-in-jackson-databind"},{"cve":"CVE-2020-35491","cvss":3.1,"epss":0.0775,"slug":"cve-2020-35491-serialization-gadgets-exploit-in-jackson-databind","title":"Serialization gadgets exploit in jackson-databind","severity":"low","exploited":false,"published_at":"2021-12-09T19:15:11+00:00","url":"https://junglewise.ai/threats/cve-2020-35491-serialization-gadgets-exploit-in-jackson-databind"},{"cve":"CVE-2020-24616","cvss":3.1,"epss":0.0758,"slug":"cve-2020-24616-code-injection-in-jackson-databind","title":"Code Injection in jackson-databind","severity":"low","exploited":false,"published_at":"2021-12-09T19:14:51+00:00","url":"https://junglewise.ai/threats/cve-2020-24616-code-injection-in-jackson-databind"},{"cve":"CVE-2020-35490","cvss":3.1,"epss":0.0629,"slug":"cve-2020-35490-serialization-gadgets-exploit-in-jackson-databind","title":"Serialization gadgets exploit in jackson-databind","severity":"low","exploited":false,"published_at":"2021-12-09T19:15:00+00:00","url":"https://junglewise.ai/threats/cve-2020-35490-serialization-gadgets-exploit-in-jackson-databind"},{"cve":"CVE-2020-11113","cvss":3.1,"epss":0.0628,"slug":"cve-2020-11113-jackson-databind-mishandles-the-interaction-between-serialization","title":"jackson-databind mishandles the interaction between serialization gadgets and typing","severity":"low","exploited":false,"published_at":"2020-05-15T18:58:47+00:00","url":"https://junglewise.ai/threats/cve-2020-11113-jackson-databind-mishandles-the-interaction-between-serialization"}],"generated_at":"2026-09-27T03:07:00.185062+00:00"}