xwiki vulnerabilities

CVEs per yearBy the year they were published

1. 20203
2. 202242
3. 202210
4. 2023112
5. 202540
6. 202532
7. 202611

Known exploitedNewest addition to KEV first

• CVE-2025-24893

  Remote code execution as guest via SolrSearchMacros request in xwiki

  xwiki · xwiki-platform

  ExploitedCritical9.8

Newest CVEs

• CVE-2025-53837

  org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

  xwiki · xwiki-rendering

  Critical9.9
• CVE-2026-53966

  XWiki Platform: Privilege escalation from edit to script right through Live Data editing

  xwiki · xwiki-platform

  High7.1
• CVE-2026-34151

  XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+

  xwiki · xwiki-platform

  High8.2
• CVE-2026-48048

  XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

  xwiki · xwiki-platform

  High7.5
• CVE-2026-48047

  XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

  xwiki · xwiki-platform

  Medium5.9
• CVE-2026-33137

  XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}

  xwiki · xwiki-platform

  Critical9.3
• CVE-2026-23734

  XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash

  xwiki · xwiki-commons

  Critical9.3
• CVE-2026-40105

  XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality

  xwiki · xwiki-platform

  Medium6.5
• CVE-2026-40104

  XWiki's REST APIs can list all pages/spaces, leading to unavailability

  xwiki · org.xwiki.platform:xwiki-platform-oldcore

  Medium6.9
• CVE-2026-33229

  XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API

  xwiki · xwiki-platform

  High8.6