https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T08:18:12.903543+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2022-13405 cnvd-2022-13405 2026-10-10T08:18:12.976764+00:00 cnvd-2022-13405 https://cve.radiocsirt.org/vuln/euvd-2026-234457 EUVD-2026-234457 2026-10-10T08:18:12.976813+00:00 EUVD-2026-234457 https://cve.radiocsirt.org/vuln/fkie_cve-2022-23619 fkie_cve-2022-23619 2026-10-10T08:18:12.976828+00:00

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. This problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1. Users are advised yo update. There are no known workarounds for this issue.

 https://cve.radiocsirt.org/vuln/ghsa-35fg-hjcr-j65f GHSA-35fg-hjcr-j65f — Information exposure in xwiki-platform 2026-10-10T08:18:12.976861+00:00

Affected: Maven: org.xwiki.platform:xwiki-platform-web

### Impact It's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users.

### Patches The problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1.

### Workarounds There's no easy workaround other than applying the upgrade.

### References

https://jira.xwiki.org/browse/XWIKI-18787

### For more information If you have any questions or comments about this advisory: * Open an issue in [JIRA](https://jira.xwiki.org) * Email us at [XWiki Security Mailing list](mailto:security@xwiki.org)

 https://cve.radiocsirt.org/vuln/gsd-2022-23619 gsd-2022-23619 2026-10-10T08:18:12.976895+00:00 gsd-2022-23619