Hibernate
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Hibernate product.
RSS Feeds for Hibernate security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Hibernate products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Hibernate Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2025 there have been 0 vulnerabilities in Hibernate. Last year, in 2024 Hibernate had 1 security vulnerability published. Right now, Hibernate is on track to have less security vulnerabilities in 2025 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2025 | 0 | 0.00 |
| 2024 | 1 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 0 | 0.00 |
| 2020 | 2 | 6.95 |
| 2019 | 1 | 6.10 |
It may take a day or so for new Hibernate vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Hibernate Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2023-1932 | Nov 07, 2024 |
Hibernate-Validator SafeHtmlValidator XSS BypassA flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks. |
Hibernate Validator
|
| CVE-2020-25638 | Dec 02, 2020 |
A flaw was found in hibernate-core in versions prior to and including 5.4.23.FinalA flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity. |
Hibernate Orm
|
| CVE-2019-14900 | Jul 06, 2020 |
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. |
Hibernate Orm
|
| CVE-2019-10219 | Nov 08, 2019 |
A vulnerability was found in Hibernate-ValidatorA vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack. |
Hibernate Validator
|