Apache Software Foundation Apache Commons Bcel vulnerabilities

2 CVEs affecting Apache Software Foundation Apache Commons Bcel, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-94114, published 2026-10-06.

More from Apache Software Foundation.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-94114, published 2026-10-06. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and…
• CVE-2026-105111, published 2026-10-06. Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for…