Login Request a demo
MO
Product
Mojarra
by Eclipse · last CVE Aug 5, 2026
4
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Vulnerabilities4In the news0Timeline
Severity mix
Critical 0High 2Medium 2Low 0
Severity
All severities4Critical0High2Medium2Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Mojarra to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-46581
7.5
1%
Aug 5
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to…
Affected: 2.3.0 through 4.1.13; 5.0.0; 5.0.0; 5.0.0; 5.0.0; 5.0.0
CVE-2018-14371
7.5
4%
Jul 18
The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter
Affected: before 2.3.7
CVE-2020-6950
6.5
10%
Jun 2
Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter
Affected: before 2.3.14
CVE-2019-17091
6.1
2%
Oct 2
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS…
Affected: 2.3.0 before 2.3.10
Showing 4