X
Vendor security profile1 actively exploited CVEs
xwiki
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs15
Critical2
CISA KEV1
Public exploit9
Patch rate%67
Avg. CVSS7.9
12-month vulnerability rate
0
5
0
0
1
1
0
0
0
2
3
0
CVE KEV
CVE severity distribution
15toplam CVE
Critical2 (13%)
High10 (67%)
Medium2 (13%)
Uncertain1 (7%)
Patch and exploitation view
%67
Verified patch
%7
CISA KEV
%60
Public exploit
10Patch available
0Partial
1Workaround
0Vendor: no patch
4Unknown
Latest vulnerabilities
9.9
CVE-2025-53837
org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue
X
Patch status unknownEPSS %1
7.1
CVE-2026-53966
XWiki Platform: Privilege escalation from edit to script right through Live Data editing
X
Patch verifiedEPSS %1
8.2
CVE-2026-34151
XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+
X
Patch verifiedEPSS %1
7.5
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests
X
Patch status unknownEPSS %1
5.9
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin
X
Patch status unknownEPSS %1
9.8
CVE-2026-33229
Missing authorization in Xwiki
X
Patch verifiedEPSS %1
8.6
CVE-2025-66024
XWiki Blog Application home page vulnerable to Stored XSS via Post Title
X
Patch verifiedEPSS %0
8.8
CVE-2025-66474
Code injection in Xwiki Rendering
X
Patch verifiedEPSS %1
7.5
CVE-2025-66473
Resource allocation without limits in Xwiki
X
Patch verifiedEPSS %0
6.1
CVE-2025-66472
Cross-site scripting in Xwiki
X
Patch verifiedEPSS %1