eclipse_mojarra vulnerabilities

CVEs whose affected-version data names the eclipse_mojarra package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-120421Medium· 6.1

4d ago

Reflected XSS via client window id in URL client window mode

In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.fa…

▾ SunlitEclipse Foundation · Eclipse MojarraEPSS 0.21%via CVEORG