Xuxueli has 6 CVEs on record. Disclosure cadence is accelerating: 5 in the last 90 days against 1 in the 90 before. The busiest recent month was September 2026 with 5. The median CVSS is 3.9 (low). None have a confirmed exploitation report. The dominant weakness classes are CWE-94 (4) and CWE-79 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 3.9
- Publish → KEV
- —
- Last 90 days
- 5 prev 1
Worst active — by depth score
CVE-2026-90488Medium· 6.3A vulnerability was determined in Xuxueli xxl-job up to 3.4.247CVE-2026-65316Medium· 6.5xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat36CVE-2026-94426Low· 3.5A vulnerability was determined in xuxueli xxl-job up to 3.5.031CVE-2026-94145Low· 3.5A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.031CVE-2026-90489Low· 3.5A vulnerability was identified in Xuxueli xxl-job up to 3.5.031
Xuxueli vulnerabilities
CVEs affecting Xuxueli, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-94426Low· 3.5PoCA vulnerability was determined in xuxueli xxl-job up to 3.5.0
A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remo…
CVE-2026-94145Low· 3.5PoCA vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0
A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Manag…
CVE-2026-90489Low· 3.5PoCA vulnerability was identified in Xuxueli xxl-job up to 3.5.0
A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed r…
CVE-2026-90488Medium· 6.3PoCA vulnerability was determined in Xuxueli xxl-job up to 3.4.2
A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection.…
CVE-2026-90487Medium· 4.3A vulnerability was found in Xuxueli xxl-job up to 3.4.2
A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation result…
CVE-2026-65316Medium· 6.5xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat
XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to…