https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 11:33:51 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-02020 bdu:2026-02020 https://cve.radiocsirt.org/vuln/bdu:2026-02020 https://cve.radiocsirt.org/vuln/euvd-2026-268243 EUVD-2026-268243 https://cve.radiocsirt.org/vuln/euvd-2026-268243 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26000 <p>XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it&#39;s possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.</p> <p>XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it&#39;s possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-26000 https://cve.radiocsirt.org/vuln/ghsa-74rh-c5rh-88vg <p><strong>Affected:</strong> Maven: org.xwiki.platform:xwiki-platform-web</p> <p>### Impact</p> <p>It&#39;s possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. All versions of XWiki are impacted by this kind of attack.</p> <p>### Patches</p> <p>The problem has been patched not by preventing injecting CSS in comments, which is currently a feature of XWiki, but by requiring confirmation from users when driving them to untrusted domains after clicking on a link, thus preventing any click-jacking attack. This security measure has been put in place in XWiki 17.9.0, 17.4.6, 16.10.13.</p> <p>### Workarounds</p> <p>There&#39;s no out-of-the-box workaround, but it should be possible to partly reuse [the javascript code provided for the security measure](https://github.com/xwiki/xwiki-platform/blob/xwiki-platform-17.9.0/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-war/src/main/webapp/resources/uicomponents/link/link-protection.js) in a JSX object inside the wiki, to request the same kind of confirmation.</p> <p>### References * JIRA ticket: https://jira.xwiki.org/browse/XWIKI-23433 * Documentation of the new security measure: https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/17.9.0RC1/Entry006/ * Commit for the security fix: https://github.com/xwiki/xwiki-platform/commit/29cb81f3a5387cf822d7e7534bdd63903275f86b</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xw…</p> <p><strong>Affected:</strong> Maven: org.xwiki.platform:xwiki-platform-web</p> <p>### Impact</p> <p>It&#39;s possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. All versions of XWiki are impacted by this kind of attack.</p> <p>### Patches</p> <p>The problem has been patched not by preventing injecting CSS in comments, which is currently a feature of XWiki, but by requiring confirmation from users when driving them to untrusted domains after clicking on a link, thus preventing any click-jacking attack. This security measure has been put in place in XWiki 17.9.0, 17.4.6, 16.10.13.</p> <p>### Workarounds</p> <p>There&#39;s no out-of-the-box workaround, but it should be possible to partly reuse [the javascript code provided for the security measure](https://github.com/xwiki/xwiki-platform/blob/xwiki-platform-17.9.0/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-war/src/main/webapp/resources/uicomponents/link/link-protection.js) in a JSX object inside the wiki, to request the same kind of confirmation.</p> <p>### References * JIRA ticket: https://jira.xwiki.org/browse/XWIKI-23433 * Documentation of the new security measure: https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/17.9.0RC1/Entry006/ * Commit for the security fix: https://github.com/xwiki/xwiki-platform/commit/29cb81f3a5387cf822d7e7534bdd63903275f86b</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xw…</p> https://cve.radiocsirt.org/vuln/ghsa-74rh-c5rh-88vg https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0412 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in xwiki ausnutzen, um falsche Informationen darzustellen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in xwiki ausnutzen, um falsche Informationen darzustellen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0412