Known vulnerabilities in XWiki platform 16.10.0-rc-1

Vendor: XWiki
Version: 16.10.0-rc-1
Software CPE: cpe:2.3:a:xwiki:xwiki-platform:*:*:*:*:*:*:*:*
Total vulnerabilities: 83
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting XWiki platform version 16.10.0-rc-1 XWiki platform 16.10.0-rc-1 is affected by 83 vulnerabilities: 9 high, 51 medium, 23 low Critical High Medium Low

Vulnerabilities (83)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU132086 - Exposure of Private Information ('Privacy Violation')
CVE-2026-48048
CWE-359 Medium
No
No
16.10.17, 17.4.9, 17.10.3 21.05.2026 SB2026052151
#VU132085 - Path Traversal: \'../filedir\'
CVE-2026-48047
CWE-24 Low
No
No
16.10.17, 17.4.9, 17.10.3 21.05.2026 SB2026052151
#VU129897 - Allocation of Resources Without Limits or Throttling
CVE-2026-40104
CWE-770 Medium
No
No
16.10.16, 17.4.8, 17.10.1 05.05.2026 SB2026050585
#VU129896 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2026-40105
CWE-80 High
No
No
16.10.16, 17.4.8, 17.10.1 05.05.2026 SB2026050585
#VU129895 - Improper Restriction of Rendered UI Layers or Frames
CVE-2026-26000
CWE-1021 Medium
No
No
16.10.13, 17.4.6, 17.9.0 05.05.2026 SB2026050584
#VU129894 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2025-66472
CWE-80 High
No
No
16.10.10, 17.4.2 05.05.2026 SB2026050582
#VU129893 - Allocation of Resources Without Limits or Throttling
CVE-2025-66473
CWE-770 Medium
No
No
16.10.11, 17.4.4, 17.7.0 05.05.2026 SB2026050583
#VU129892 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-52472
CWE-89 High
No
No
16.10.9, 17.4.2, 17.5.0 05.05.2026 SB2026050582
#VU129890 - Relative Path Traversal
CVE-2025-55748
CWE-23 High
No
No
16.10.7, 17.4.0 05.05.2026 SB2026050581
#VU129888 - Exposure of Private Information ('Privacy Violation')
CVE-2025-54124
CWE-359 Low
No
No
16.4.7, 16.10.5, 17.2.0 05.05.2026 SB2026050580
#VU129887 - Exposure of Private Information ('Privacy Violation')
CVE-2025-54125
CWE-359 Medium
No
No
16.4.7, 16.10.5, 17.2.0 05.05.2026 SB2026050580
#VU129886 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-32430
CWE-79 Medium
No
No
16.4.8, 16.10.6, 17.3.0 rc-1 05.05.2026 SB2026050581
#VU129884 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-49587
CWE-79 Low
No
No
15.10.16, 16.4.7, 16.10.2 05.05.2026 SB2026050580
#VU129882 - Improper Access Control
CVE-2025-49586
CWE-284 Medium
No
No
16.4.7, 16.10.3, 17.0.0 05.05.2026 SB2026050580
#VU129879 - Incorrect Authorization
CVE-2025-49582
CWE-863 Medium
No
No
16.4.7, 16.10.3, 17.0.0 05.05.2026 SB2026050580
#VU129877 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-56158
CWE-89 High
No
No
15.10.16, 16.4.7, 16.10.2 05.05.2026 SB2026050580
#VU129876 - Improper Access Control
CVE-2025-48063
CWE-284 Low
No
No
16.10.4, 17.1.0 05.05.2026 SB2026050580
#VU122033 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-24128
CWE-79 Low
No
No
16.10.12, 17.4.5, 17.8.0 rc-1 26.01.2026 SB2026012636
#VU129874 - Missing Authorization
CVE-2025-32968
CWE-862 Low
No
No
15.10.16, 16.4.6, 16.10.1 23.04.2025 SB2026050580
#VU129875 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-32969
CWE-89 High
No
No
15.10.16, 16.4.6, 16.10.1 23.04.2025 SB2026050580


Showing elements 1 - 20 out of 83