Where
-Infinity
0

Trending

Last week
Last month
Last year

maven/org.xwiki.platform:xwiki-platform-legacy-oldcoreXWiki's REST APIs can list all pages/spaces, leading to unavailability

Risk 54
Severity
6.9
First published (updated )
CVE-2026-40104

maven/org.xwiki.platform:xwiki-platform-web-templatesXWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality

Risk 71
Severity
6.5
First published (updated )
CVE-2026-40105

maven/org.xwiki.platform:xwiki-platform-legacy-oldcoreXWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API

Risk 86
Severity
8.6
First published (updated )
CVE-2026-33229

maven/org.xwiki.platform:xwiki-platform-webXWiki Platform affected by click-jacking through CSS injection in comments

Risk 27
Severity
6.1
EPSS
0.03%
First published (updated )
CVE-2026-26000

XWiki xwikiXWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

Risk 51
Severity
6.5
EPSS
0.04%
First published (updated )
CVE-2026-24128
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

maven/org.xwiki.platform:xwiki-platform-rest-serverXWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis

Risk 47
Severity
8.7
First published (updated )
CVE-2025-66473

maven/org.xwiki.platform:xwiki-platform-web-templatesXWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

Risk 71
Severity
6.5
First published (updated )
CVE-2025-66472

maven/org.xwiki.platform:xwiki-platform-tool-jetty-resourcesThe XWiki Jetty package (XJetty) allows accessing any application file through URL

Risk 47
Severity
8.7
First published (updated )
CVE-2025-55749

maven/org.xwiki.platform:xwiki-platform-oldcoreXWiki allows SQL injection in query endpoint of REST API with Oracle

Risk 86
Severity
9.8
First published (updated )
CVE-2024-56158

XWiki xwikiThe WikiManager REST API allows any user to create wikis

Risk 61
Severity
7.9
EPSS
0.07%
First published (updated )
CVE-2025-29926
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

maven/org.xwiki.platform:xwiki-platform-rest-serverXWiki allows unregistered users to access private pages information through REST endpoint

Risk 33
Severity
8.7
EPSS
0.08%
First published (updated )
CVE-2025-29925

XWiki xwikiXWiki uses the wrong wiki reference in AuthorizationManager

Risk 33
Severity
8.7
EPSS
0.07%
First published (updated )
CVE-2025-29924

XWiki xwikiXWiki Platform Eval Injection Vulnerability

Risk 79
Severity
9.8
Exploited
EPSS
0.06%
First published (updated )
CVE-2025-24893

maven/org.xwiki.platform:xwiki-platform-distribution-warXWiki Denial of Service attack through attachments

Risk 31
Severity
7.5
EPSS
0.05%
First published (updated )
CVE-2024-21651

XWiki xwikiXWiki has no right protection on rollback action

Risk 58
Severity
8.8
EPSS
0.06%
First published (updated )
CVE-2024-21648
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

maven/org.xwiki.platform:xwiki-platform-administration-uiXWiki Remote Code Execution vulnerability via user registration

Risk 63
Severity
10
EPSS
0.58%
First published (updated )
CVE-2024-21650

maven/org.xwiki.platform:xwiki-platform-skin-uiImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui

Risk 84
Severity
10
First published (updated )
CVE-2023-37462

maven/org.xwiki.platform:xwiki-platform-rest-serverXWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API

Risk 81
Severity
9.6
First published (updated )
CVE-2023-37277

XWiki xwikiPersistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki Platform

Risk 76
Severity
9
First published (updated )
CVE-2023-36477

XWiki xwikiUpgrading doesn't prevent exploiting vulnerable XWiki documents

Risk 84
Severity
10
First published (updated )
CVE-2023-36468
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

XWiki xwikiCode injection through NotificationRSSService in XWiki Platform

Risk 84
Severity
10
First published (updated )
CVE-2023-36469

XWiki xwikiCode injection in icon themes of XWiki Platform

Risk 84
Severity
10
First published (updated )
CVE-2023-36470

XWiki xwikiXWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template

Risk 80
Severity
9.7
First published (updated )
CVE-2023-35158

XWiki xwikiXWiki Platform vulnerable to cross-site scripting in target parameter via share page by email

Risk 64
Severity
8.8
First published (updated )
CVE-2023-35155

XWiki xwikiXWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters

Risk 75
Severity
9.1
First published (updated )
CVE-2023-35153
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

XWiki xwikiXWiki Platform's tags on non-viewable pages can be revealed to users

Risk 22
Severity
4.3
First published (updated )
CVE-2023-34466

XWiki xwikiXWiki Platform's Mail.MailConfig can be edited by any user with edit rights

Risk 83
Severity
10
First published (updated )
CVE-2023-34465

XWiki xwikiXWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template

Risk 75
Severity
9.1
First published (updated )
CVE-2023-34464

XWiki xwikiXWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page

Risk 81
Severity
9.6
First published (updated )
CVE-2023-35161

XWiki xwikiXWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template

Risk 81
Severity
9.6
First published (updated )
CVE-2023-35160
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203