Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
CVE-2026-34151
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ 14 Sep
  • Fix available
  • Severity - 8.2 (High)
CVE-2026-23734
  • github.com/xwiki/xwiki-commons
 XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash 20 May
  • Fix available
  • Severity - 9.3 (Critical)
CVE-2026-40105
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality 15 Apr
  • Fix available
  • Severity - 6.5 (Medium)
CVE-2026-40104
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki's REST APIs can list all pages/spaces, leading to unavailability 15 Apr
  • Fix available
  • Severity - 6.9 (Medium)
CVE-2026-33229
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API 08 Apr
  • Fix available
  • Severity - 8.6 (High)
CVE-2026-26000
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki Platform affected by click-jacking through CSS injection in comments 12 Feb
  • Fix available
  • Severity - 5.3 (Medium)
CVE-2026-24128
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages 23 Jan
  • Fix available
  • Severity - 6.5 (Medium)
CVE-2025-66473
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis 10 Dec 2025
  • Fix available
  • Severity - 8.7 (High)
CVE-2025-66472
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication 10 Dec 2025
  • Fix available
  • Severity - 6.5 (Medium)
CVE-2025-55749
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 The XWiki Jetty package (XJetty) allows accessing any application file through URL 01 Dec 2025
  • Fix available
  • Severity - 8.7 (High)
CVE-2025-55748
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki Platform's configuration files can be accessed through jsx and sx endpoints 03 Sep 2025
  • Fix available
  • Severity - 9.3 (Critical)
CVE-2025-55747
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki Platform's configuration files can be accessed through the webjars API 03 Sep 2025
  • Fix available
  • Severity - 9.3 (Critical)
CVE-2025-58049
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki PDF export jobs store sensitive cookies unencrypted in job statuses 28 Aug 2025
  • Fix available
  • Severity - 5.8 (Medium)
CVE-2025-51990
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 See record for full details 20 Aug 2025
  • No fix available
  • Severity - 4.8 (Medium)
CVE-2025-51991
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 See record for full details 20 Aug 2025
  • No fix available
  • Severity - 8.8 (High)
CVE-2025-54125
  • github.com/xwiki/xwiki-commons
  • github.com/xwiki/xwiki-platform
 XWiki Platform: Password and email exposure in xml.vm fields 05 Aug 2025
  • Fix available
  • Severity - 8.7 (High)
Load more...