# org.zkoss.zk:zk (Maven) vulnerabilities

1 known vulnerability (1 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 10.3.0.1-jakarta (Jul 22, 2026): no advisory affects it
- Newest unaffected release: 10.3.0.1-jakarta (Jul 22, 2026), the latest release
- Dependents: 20
- Releases: 82 since 2.1.3 (Nov 27, 2006)
- Registry: https://central.sonatype.com/artifact/org.zkoss.zk/zk
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2022-36537: 2.1.3 to 8.6.0.1 (9.0.0-RC is outside it); 9.0.0 to 9.6.0.1-jakarta (9.6.0.2 is outside it)

## Advisories (1)

### [CVE-2022-36537](https://cve.now/CVE-2022-36537): ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent

- Severity: High 7.5 · KEV
- Published: Aug 26, 2022
- Affected: fixed in 8.6.4.2; from 9.0.0.0, fixed in 9.0.1.3; from 9.5.0.0, fixed in 9.5.1.4; from 9.6.0.0, fixed in 9.6.0.2; from 9.6.1, fixed in 9.6.2.
- Fixed in 9.6.0.2 (released May 27, 2022, 91 days before disclosure, the advisory names 8.6.4.2, which was never published) and 10.0.0 (released Feb 27, 2024, 550 days after disclosure, the advisory names 9.6.2, which was never published).
- The latest release, 10.3.0.1-jakarta, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.zkoss.zk:zk
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.