Known vulnerabilities in Eclipse Foundation Eclipse Mojarra
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-120421 | Reflected XSS via client window id in URL client window mode | 6.1 Medium | Nov 4, 2026 |
| CVE-2026-46581 | In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize… | 7.5 High | Aug 5, 2026 |