XW
Vendor
xwiki-contrib
12
CVEs
0
On KEV
0
New 30D
Products
MC6.4
Mocca Calendar
xwiki-contrib
3 CVEs0 on KEV0 new
MA10.0
macro-fullcalendar
xwiki-contrib
2 CVEs0 on KEV0 new
OI9.2
oidc
xwiki-contrib
2 CVEs0 on KEV0 new
AP8.7
application-blog
xwiki-contrib
1 CVEs0 on KEV0 new
AP9.0
application-blog-ui
xwiki-contrib
1 CVEs0 on KEV0 new
JI7.7
jira
xwiki-contrib
1 CVEs0 on KEV0 new
MA4.4
macro-plantuml
xwiki-contrib
1 CVEs0 on KEV0 new
SY9.0
syntax-markdown
xwiki-contrib
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-42140 | MA macro-plantuml xwiki-contrib | 4.4 | May 4 | Server-Side Request Forgery (SSRF) in PlantUML Macro via 'server' parameter |
| CVE-2025-66024 | AP application-blog-ui xwiki-contrib | 9.0 | Mar 4 | XWiki Blog Application home page vulnerable to Stored XSS via Post Title |
| CVE-2025-65091 | MA macro-fullcalendar xwiki-contrib | 10.0 | Jan 10 | XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService |
| CVE-2025-65090 | MA macro-fullcalendar xwiki-contrib | 5.3 | Jan 10 | XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService |
| CVE-2025-49594 | OI oidc xwiki-contrib | 9.2 | Oct 6 | XWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` right |
| CVE-2025-58365 | AP application-blog xwiki-contrib | 8.7 | Sep 8 | XWiki Blog Application: Privilege Escalation (PR) from account through blog content |
| CVE-2025-52133 | MC Mocca Calendar xwiki-contrib | 6.4 | Aug 3 | The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import |
| CVE-2025-52132 | MC Mocca Calendar xwiki-contrib | 6.4 | Aug 3 | The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page |
| CVE-2025-52131 | MC Mocca Calendar xwiki-contrib | 6.4 | Aug 3 | The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field |
| CVE-2025-46558 | SY syntax-markdown xwiki-contrib | 9.0 | Apr 30 | org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content |
| CVE-2025-31487 | JI jira xwiki-contrib | 7.7 | Apr 3 | The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server |
| CVE-2022-39387 | OI oidc xwiki-contrib | 7.5 | Nov 4 | XWiki OIDC Authenticator vulnerable to OpenID login bypass due to improper authentication |