https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-10T17:41:57.496505+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-120421 fkie_cve-2026-120421 2026-11-10T17:41:57.497811+00:00

In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.

 https://db.gcve.eu/vuln/ghsa-4hw7-pfg5-v529 GHSA-4hw7-pfg5-v529 2026-11-10T17:41:57.497869+00:00

In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.

 https://db.gcve.eu/vuln/ubuntu-cve-2026-120421 UBUNTU-CVE-2026-120421 2026-11-10T17:41:57.497891+00:00

Affected: Ubuntu:16.04:LTS: mojarra, Ubuntu:18.04:LTS: mojarra, Ubuntu:20.04:LTS: mojarra, Ubuntu:22.04:LTS: mojarra, Ubuntu:24.04:LTS: mojarra, Ubuntu:26.10: mojarra, Ubuntu:26.04:LTS: mojarra

In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.