CVE-2026-68536

A flaw was found in Apache MyFaces Core. This vulnerability allows a remote attacker to perform Server-Side Request Forgery SSRF, which can trick the server into making requests to arbitrary domains, potentially accessing internal resources. Additionally, Local File Inclusion LFI is possible,...

org.apache.myfaces.core:myfaces-core-assembly (>=2.3.1, <=2.3.11) potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-bundle (>=2.3.1, <=2.3.11)

org.apache.myfaces.core:myfaces-bundle MAVEN version =2.3.1, =2.3.1, =2.3.11 Source cves: CVE-2026-76646 Source advisory: MEND:CVE-2026-76646...

org.apache.myfaces.core:myfaces-core-assembly (>=3.0.0, <=3.0.3) potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-bundle (>=3.0.0, <=3.0.3)

org.apache.myfaces.core:myfaces-bundle MAVEN version =3.0.0, =3.0.0, =3.0.3 Source cves: CVE-2026-76646 Source advisory: MEND:CVE-2026-76646...

org.apache.myfaces.core:myfaces-core-assembly (>=4.0.0, <=4.0.3) potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-bundle (>=4.0.0, <=4.0.3)

org.apache.myfaces.core:myfaces-bundle MAVEN version =4.0.0, =4.0.0, =4.0.3 Source cves: CVE-2026-76646 Source advisory: MEND:CVE-2026-76646...

org.apache.myfaces.core:myfaces-core-assembly (>=4.1.0, <=4.1.3) potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-bundle (>=4.1.0, <=4.1.3)

org.apache.myfaces.core:myfaces-bundle MAVEN version =4.1.0, =4.1.0, =4.1.3 Source cves: CVE-2026-76646 Source advisory: MEND:CVE-2026-76646...

org.apache.myfaces.core:myfaces-core-assembly (>=2.3-next-m1, <=2.3-next-m8) potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-bundle (>=2.3-next-m1, <=2.3-next-m8)

org.apache.myfaces.core:myfaces-bundle MAVEN version =2.3-next-m1, =2.3-next-m1, =2.3-next-m8 Source cves: CVE-2026-76646 Source advisory: MEND:CVE-2026-76646...

CVE-2026-68536 Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue...

CVE-2026-68536

A flaw in Apache MyFaces Core allows a remote attacker to perform Server-Side Request Forgery (SSRF) , which can trick the server into making requests to arbitrary domains to access internal resources. Additionally, the vulnerability allows for Local File Inclusion (LFI) , enabling attackers to i...

org.apache.myfaces.core:myfaces-core-assembly (>=2.3.1, <=2.3.11) potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-bundle (>=2.3.1, <=2.3.11)

org.apache.myfaces.core:myfaces-bundle MAVEN version =2.3.1, =2.3.1, =2.3.11 Source cves: CVE-2026-68536 Source advisory: MEND:CVE-2026-68536...

org.apache.myfaces.core:myfaces-core-assembly (>=3.0.0-rc1, <=3.0.3) potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-bundle (>=3.0.0-rc1, <=3.0.3)

org.apache.myfaces.core:myfaces-bundle MAVEN version =3.0.0-rc1, =3.0.0-rc1, =3.0.3 Source cves: CVE-2026-68536 Source advisory: MEND:CVE-2026-68536...

org.apache.myfaces.core:myfaces-core-assembly (>=4.0.0-rc1, <=4.0.3) potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-bundle (>=4.0.0-rc1, <=4.0.3)

org.apache.myfaces.core:myfaces-bundle MAVEN version =4.0.0-rc1, =4.0.0-rc1, =4.0.3 Source cves: CVE-2026-68536 Source advisory: MEND:CVE-2026-68536...

org.apache.myfaces.core:myfaces-core-assembly (>=4.1.0-rc1, <=4.1.3) potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-bundle (>=4.1.0-rc1, <=4.1.3)

org.apache.myfaces.core:myfaces-bundle MAVEN version =4.1.0-rc1, =4.1.0-rc1, =4.1.3 Source cves: CVE-2026-68536 Source advisory: MEND:CVE-2026-68536...

org.apache.myfaces.core:myfaces-core-assembly (>=2.3-next-m1, <=2.3-next-m8) potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-bundle (>=2.3-next-m1, <=2.3-next-m8)

org.apache.myfaces.core:myfaces-bundle MAVEN version =2.3-next-m1, =2.3-next-m1, =2.3-next-m8 Source cves: CVE-2026-68536 Source advisory: MEND:CVE-2026-68536...

PT-2026-93897

Name of the Vulnerable Software and Affected Versions Apache MyFaces Core versions prior to 2.3.12 Apache MyFaces Core versions prior to 2.3-next-M9 Apache MyFaces Core versions prior to 3.0.4 Apache MyFaces Core versions prior to 4.0.4 Apache MyFaces Core versions prior to 4.1.4 Description An...

EUVD-2022-4414

Malicious code in bioql PyPI...

CVE-2021-26296

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery CSRF tokens. Due to that limitation, it is possible although difficult for an attacker ...

CVE-2021-26296

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery CSRF tokens. Due to that limitation, it is possible although difficult for an attacker ...

CVE-2021-26296

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery CSRF tokens. Due to that limitation, it is possible although difficult for an attacker ...

PT-2021-16989

Name of the Vulnerable Software and Affected Versions Apache MyFaces Core versions 2.2.0 through 2.2.13 Apache MyFaces Core versions 2.3.0 through 2.3.7 Apache MyFaces Core versions 2.3-next-M1 through 2.3-next-M4 Apache MyFaces Core version 3.0.0-RC1 Description The issue arises from the use of...

CVE-2021-26296: Cross-Site Request Forgery (CSRF)

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery CSRF tokens. Due to that limitation, it is possible although difficult for an attacker ...