{"schema_version":1,"title":"XXL-JOB vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 9 vulnerabilities in XXL-JOB: 0 in the last 7 days and 6 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-90489, was published on 13 September 2026.","url":"https://junglewise.ai/threats/technologies/xxl-job","json_url":"https://junglewise.ai/threats/technologies/xxl-job.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/xxl-job","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":0,"all_time":9,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":3,"last_90_days":6,"last_365_days":9},"latest":[{"cve":"CVE-2026-90489","cvss":3.5,"epss":0.0033,"slug":"cve-2026-90489-xuxueli-xxl-job-cross-site-scripting-in-job-info-insert","title":"Xuxueli xxl-job cross-site scripting in job info insert","severity":"low","exploited":false,"published_at":"2026-09-13T00:17:06.853+00:00","url":"https://junglewise.ai/threats/cve-2026-90489-xuxueli-xxl-job-cross-site-scripting-in-job-info-insert"},{"cve":"CVE-2026-90488","cvss":6.3,"epss":0.0039,"slug":"cve-2026-90488-xuxueli-xxl-job-remote-code-execution-in-groovy-class-loader","title":"Xuxueli xxl-job remote code execution in Groovy class loader","severity":"medium","exploited":false,"published_at":"2026-09-13T00:17:06.68+00:00","url":"https://junglewise.ai/threats/cve-2026-90488-xuxueli-xxl-job-remote-code-execution-in-groovy-class-loader"},{"cve":"CVE-2026-90487","cvss":4.3,"epss":0.0035,"slug":"cve-2026-90487-xuxueli-xxl-job-privilege-escalation-in-jobgroupcontroller","title":"Xuxueli xxl-job privilege escalation in JobGroupController","severity":"medium","exploited":false,"published_at":"2026-09-12T23:17:01.307+00:00","url":"https://junglewise.ai/threats/cve-2026-90487-xuxueli-xxl-job-privilege-escalation-in-jobgroupcontroller"},{"cve":"CVE-2026-52371","cvss":0,"slug":"cve-2026-52371-xxl-job-ssrf-in-jobinfo-trigger-component","title":"XXL-JOB SSRF in jobinfo trigger component","severity":"info","exploited":false,"published_at":"2026-07-31T22:17:02.673+00:00","url":"https://junglewise.ai/threats/cve-2026-52371-xxl-job-ssrf-in-jobinfo-trigger-component"},{"cve":"CVE-2026-65316","cvss":6.5,"slug":"cve-2026-65316-xuxueli-xxl-job-idor-in-logdetailcat-endpoint","title":"xuxueli XXL-JOB IDOR in logDetailCat endpoint","severity":"medium","exploited":false,"published_at":"2026-07-21T22:19:10.197+00:00","url":"https://junglewise.ai/threats/cve-2026-65316-xuxueli-xxl-job-idor-in-logdetailcat-endpoint"},{"cve":"CVE-2026-26719","cvss":0,"slug":"cve-2026-26719-xxl-job-xxl-job-admin-stored-xss-in-jobinfocontroller","title":"xxl-job xxl-job-admin stored XSS in JobInfoController","severity":"info","exploited":false,"published_at":"2026-07-15T22:16:46.1+00:00","url":"https://junglewise.ai/threats/cve-2026-26719-xxl-job-xxl-job-admin-stored-xss-in-jobinfocontroller"},{"cve":"CVE-2026-7306","cvss":5.6,"epss":0.0033,"slug":"cve-2026-7306-xuxueli-xxl-job-hard-coded-default-token-in-openapi-endpoint","title":"Xuxueli xxl-job hard-coded default token in OpenAPI endpoint","severity":"medium","exploited":false,"published_at":"2026-04-28T22:16:51.06+00:00","url":"https://junglewise.ai/threats/cve-2026-7306-xuxueli-xxl-job-hard-coded-default-token-in-openapi-endpoint"},{"cve":"CVE-2026-7305","cvss":6.3,"epss":0.0021,"slug":"cve-2026-7305-xuxueli-xxl-job-ssrf-in-trigger-endpoint","title":"Xuxueli xxl-job SSRF in trigger Endpoint","severity":"medium","exploited":false,"published_at":"2026-04-28T22:16:50.893+00:00","url":"https://junglewise.ai/threats/cve-2026-7305-xuxueli-xxl-job-ssrf-in-trigger-endpoint"},{"cve":"CVE-2026-7303","cvss":3.7,"epss":0.0066,"slug":"cve-2026-7303-xuxueli-xxl-job-idor-in-execution-log-handler","title":"Xuxueli xxl-job IDOR in Execution Log Handler","severity":"low","exploited":false,"published_at":"2026-04-28T22:16:50.72+00:00","url":"https://junglewise.ai/threats/cve-2026-7303-xuxueli-xxl-job-idor-in-execution-log-handler"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"XXL-JOB","slug":"xxl-job","vendor":{"name":"XXL-JOB","slug":"xxl-job","url":"https://junglewise.ai/threats/vendors/xxl-job"},"aliases":[],"category":"framework","homepage":"https://www.xuxueli.com/xxl-job/","repo_url":"https://github.com/xuxueli/xxl-job","description":"XXL-JOB is a distributed task scheduling framework.","url":"https://junglewise.ai/threats/technologies/xxl-job"},"most_severe":[{"cve":"CVE-2026-65316","cvss":6.5,"slug":"cve-2026-65316-xuxueli-xxl-job-idor-in-logdetailcat-endpoint","title":"xuxueli XXL-JOB IDOR in logDetailCat endpoint","severity":"medium","exploited":false,"published_at":"2026-07-21T22:19:10.197+00:00","url":"https://junglewise.ai/threats/cve-2026-65316-xuxueli-xxl-job-idor-in-logdetailcat-endpoint"},{"cve":"CVE-2026-90488","cvss":6.3,"epss":0.0039,"slug":"cve-2026-90488-xuxueli-xxl-job-remote-code-execution-in-groovy-class-loader","title":"Xuxueli xxl-job remote code execution in Groovy class loader","severity":"medium","exploited":false,"published_at":"2026-09-13T00:17:06.68+00:00","url":"https://junglewise.ai/threats/cve-2026-90488-xuxueli-xxl-job-remote-code-execution-in-groovy-class-loader"},{"cve":"CVE-2026-7305","cvss":6.3,"epss":0.0021,"slug":"cve-2026-7305-xuxueli-xxl-job-ssrf-in-trigger-endpoint","title":"Xuxueli xxl-job SSRF in trigger Endpoint","severity":"medium","exploited":false,"published_at":"2026-04-28T22:16:50.893+00:00","url":"https://junglewise.ai/threats/cve-2026-7305-xuxueli-xxl-job-ssrf-in-trigger-endpoint"},{"cve":"CVE-2026-7306","cvss":5.6,"epss":0.0033,"slug":"cve-2026-7306-xuxueli-xxl-job-hard-coded-default-token-in-openapi-endpoint","title":"Xuxueli xxl-job hard-coded default token in OpenAPI endpoint","severity":"medium","exploited":false,"published_at":"2026-04-28T22:16:51.06+00:00","url":"https://junglewise.ai/threats/cve-2026-7306-xuxueli-xxl-job-hard-coded-default-token-in-openapi-endpoint"},{"cve":"CVE-2026-90487","cvss":4.3,"epss":0.0035,"slug":"cve-2026-90487-xuxueli-xxl-job-privilege-escalation-in-jobgroupcontroller","title":"Xuxueli xxl-job privilege escalation in JobGroupController","severity":"medium","exploited":false,"published_at":"2026-09-12T23:17:01.307+00:00","url":"https://junglewise.ai/threats/cve-2026-90487-xuxueli-xxl-job-privilege-escalation-in-jobgroupcontroller"},{"cve":"CVE-2026-7303","cvss":3.7,"epss":0.0066,"slug":"cve-2026-7303-xuxueli-xxl-job-idor-in-execution-log-handler","title":"Xuxueli xxl-job IDOR in Execution Log Handler","severity":"low","exploited":false,"published_at":"2026-04-28T22:16:50.72+00:00","url":"https://junglewise.ai/threats/cve-2026-7303-xuxueli-xxl-job-idor-in-execution-log-handler"},{"cve":"CVE-2026-90489","cvss":3.5,"epss":0.0033,"slug":"cve-2026-90489-xuxueli-xxl-job-cross-site-scripting-in-job-info-insert","title":"Xuxueli xxl-job cross-site scripting in job info insert","severity":"low","exploited":false,"published_at":"2026-09-13T00:17:06.853+00:00","url":"https://junglewise.ai/threats/cve-2026-90489-xuxueli-xxl-job-cross-site-scripting-in-job-info-insert"},{"cve":"CVE-2026-52371","cvss":0,"slug":"cve-2026-52371-xxl-job-ssrf-in-jobinfo-trigger-component","title":"XXL-JOB SSRF in jobinfo trigger component","severity":"info","exploited":false,"published_at":"2026-07-31T22:17:02.673+00:00","url":"https://junglewise.ai/threats/cve-2026-52371-xxl-job-ssrf-in-jobinfo-trigger-component"},{"cve":"CVE-2026-26719","cvss":0,"slug":"cve-2026-26719-xxl-job-xxl-job-admin-stored-xss-in-jobinfocontroller","title":"xxl-job xxl-job-admin stored XSS in JobInfoController","severity":"info","exploited":false,"published_at":"2026-07-15T22:16:46.1+00:00","url":"https://junglewise.ai/threats/cve-2026-26719-xxl-job-xxl-job-admin-stored-xss-in-jobinfocontroller"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}