Skip to content
OpenAdvisories

Vendor

omnifaces

2 known vulnerabilities.

Products

omnifaces 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.2
    CVE-2026-102695

    OmniFaces: Forged combined-resource IDs and related output/push boundaries

    OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued i…

    omnifaces omnifaces org.omnifaces:omnifaces Maven
  • High 8.1
    CVE-2026-41883

    OmniFaces: EL injection via crafted resource name in wildcard CDN mapping

    OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Code Execution (RCE). This affects applications that use CDNResourceHandler with a wildcard CDN mappin…

    omnifaces omnifaces org.omnifaces:omnifaces Maven