XW
Product
xwiki-commons
2
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 0Medium 0Low 0
Watch
Add xwiki-commons to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-31996 | 9.8 | Apr 10 | XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution Affected: >= 3.0.1, < 14.10.19; >= 15.0-rc-1, < 15.5.4; >= 15.6-rc-1, < 15.9-rc-1 |
| CVE-2026-23734 | 9.3 | May 20 | XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash Affected: >= 4.2-milestone-2, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1 |
Showing 2