cloud.piranha.faces:piranha-faces-myfaces (>=19.12.0, <=20.12.0), com.liferay.faces:primefaces-integration-tests (>=13.0.10.liferay-patched-1, <=15.0.6.liferay-patched-1) +58 more potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-impl (>=2.3.1, <=2.3.11)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.3.1, =19.12.0, =13.0.10.liferay-patched-1, =4.0.15.0, =4.0.9.0, =8.0.0.final, =1.7.2.230613, =1.7.2.230622, =3.1.0, =2.3.1, =2.3.1, =2.3.1, =5.0.0-alpha-1, =5.0.0-alpha-1, =5.0.0-alpha-1, =5.0.0-alpha-1, =5.15.2 and more Source cves:...

io.quarkiverse.omnifaces:quarkus-omnifaces (>=4.6.2, <=5.5.1), io.quarkiverse.omnifaces:quarkus-omnifaces-deployment (>=4.6.2, <=5.5.1) +25 more potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-impl (>=4.1.0, <=4.1.3)

org.apache.myfaces.core:myfaces-impl MAVEN version =4.1.0, =4.6.2, =4.6.2, =3.15.0, =3.15.0, =3.15.0, =3.15.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.3 - org.apache.tomee.bom:tomee-webprofile 11.0.0-m1 - org.apache.tomee.maven:tomee-embedded-maven-plugin 11.0.0-m1 - org.apache.tomee:apache-tomee...

com.github.adminfaces:quarkus-omnifaces (>=1.1.0, <=1.4.0), com.github.adminfaces:quarkus-omnifaces-deployment (>=1.1.0, <=1.4.0) +15 more potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-impl (>=2.3-next-m1, <=2.3-next-m8)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.3-next-m1, =1.1.0, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.3-next-m3, =2.3-next-m1, =2.3-next-m1, =2.3-next-m1, =2.3-next-m8 and more Source cves: CVE-2026-76646 Sou...

cloud.piranha.extension:piranha-extension-myfaces (>=21.6.0, <=22.8.0), cloud.piranha.faces:piranha-faces-myfaces (>=21.3.0, <=21.5.0) +27 more potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-impl (>=3.0.0, <=3.0.3)

org.apache.myfaces.core:myfaces-impl MAVEN version =3.0.0, =21.6.0, =21.3.0, =22.3.0, =9.0.0.final, =2.0.0.230625-alpha, =2.0.0.230625-alpha, =3.2.0, =3.0.0, =3.0.0, =3.0.0, =9.0.0-m8, =9.0.0-m8, =9.0.0-m8, =9.0.0-m8, =9.0.0-m8, =9.1.3 and more Source cves: CVE-2026-76646 Source advisory:...

cloud.piranha.extension:piranha-extension-myfaces (>=22.9.0, <=22.10.0), cloud.piranha:debug (>=22.9.0, <=22.10.0) +56 more potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-impl (>=4.0.0-rc1, <=4.0.3)

org.apache.myfaces.core:myfaces-impl MAVEN version =4.0.0-rc1, =22.9.0, =22.9.0, =13.0.10.liferay-patched-1, =4.1.0, =4.1.0, =4.1.0, =4.5.1 and more Source cves: CVE-2026-68536 Source advisory: MEND:CVE-2026-68536...

com.github.adminfaces:quarkus-omnifaces (>=1.1.0, <=1.4.0), com.github.adminfaces:quarkus-omnifaces-deployment (>=1.1.0, <=1.4.0) +15 more potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-impl (>=2.3-next-m1, <=2.3-next-m8)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.3-next-m1, =1.1.0, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.3-next-m3, =2.3-next-m1, =2.3-next-m1, =2.3-next-m1, =2.3-next-m8 and more Source cves: CVE-2026-68536 Sou...

cloud.piranha.faces:piranha-faces-myfaces (>=19.12.0, <=20.12.0), com.liferay.faces:primefaces-integration-tests (>=13.0.10.liferay-patched-1, <=15.0.6.liferay-patched-1) +58 more potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-impl (>=2.3.1, <=2.3.11)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.3.1, =19.12.0, =13.0.10.liferay-patched-1, =4.0.15.0, =4.0.9.0, =8.0.0.final, =1.7.2.230613, =1.7.2.230622, =3.1.0, =2.3.1, =2.3.1, =2.3.1, =5.0.0-alpha-1, =5.0.0-alpha-1, =5.0.0-alpha-1, =5.0.0-alpha-1, =5.15.2 and more Source cves:...

io.quarkiverse.omnifaces:quarkus-omnifaces (>=4.6.0, <=5.5.1), io.quarkiverse.omnifaces:quarkus-omnifaces-deployment (>=4.6.0, <=5.5.1) +25 more potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-impl (>=4.1.0-rc1, <=4.1.3)

org.apache.myfaces.core:myfaces-impl MAVEN version =4.1.0-rc1, =4.6.0, =4.6.0, =3.14.7, =3.14.7, =3.14.7, =3.14.7, =4.1.0-rc1, =4.1.0-rc1, =4.1.0-rc1, =4.1.0-rc1, =4.1.3 - org.apache.tomee.bom:tomee-webprofile 11.0.0-m1 - org.apache.tomee.maven:tomee-embedded-maven-plugin 11.0.0-m1 -...

com.github.weblets:weblets-demo (1.2), net.java.dev.weblets:weblets-demo (>=1.0, <=1.1.1-beta-1) +44 more potentially affected by CVE-2010-2057 via org.apache.myfaces.core:myfaces-impl (>=1.1.2, <=1.1.7)

org.apache.myfaces.core:myfaces-impl MAVEN version =1.1.2, =1.0, =1.1.1, =1.1.1, =1.0.8, =1.0.8, =1.0.28 - org.apache.myfaces.tobago:tobago-example-foreach 1.0.9 - org.apache.myfaces.tobago:tobago-example-nonfacesrequest 1.0.9 - org.apache.myfaces.tobago:tobago-example-test 1.0.9 and more Source...

com.github.weblets:weblets-demo (1.2), net.java.dev.weblets:weblets-demo (>=1.0, <=1.1.1-beta-1) +44 more potentially affected by CVE-2010-2057 via org.apache.myfaces.core:myfaces-impl (>=1.1.2, <=1.1.7)

org.apache.myfaces.core:myfaces-impl MAVEN version =1.1.2, =1.0, =1.1.1, =1.1.1, =1.0.8, =1.0.8, =1.0.28 - org.apache.myfaces.tobago:tobago-example-foreach 1.0.9 - org.apache.myfaces.tobago:tobago-example-nonfacesrequest 1.0.9 - org.apache.myfaces.tobago:tobago-example-test 1.0.9 and more Source...

br.com.caelum.stella:myfaces-example (1.1), br.net.woodstock.rockframework:rockframework-web (>=1.2.1, <=1.2.2) +34 more potentially affected by CVE-2010-2057 via org.apache.myfaces.core:myfaces-impl (>=1.2.0, <=1.2.8)

org.apache.myfaces.core:myfaces-impl MAVEN version =1.2.0, =1.2.1, =2.2, =2.2, =2.1, =2.1, =2.0.1, =2.0.1, =2.2, =2.2, =1.2.1, =1.2.1, =1.0.0-alpha-2, =1.0.0-alpha-2, =2.0.0-alpha-2 and more Source cves: CVE-2010-2057 Source advisory:...

br.com.caelum.stella:myfaces-example (1.1), br.net.woodstock.rockframework:rockframework-web (>=1.2.1, <=1.2.2) +34 more potentially affected by CVE-2010-2057 via org.apache.myfaces.core:myfaces-impl (>=1.2.0, <=1.2.8)

org.apache.myfaces.core:myfaces-impl MAVEN version =1.2.0, =1.2.1, =2.2, =2.2, =2.1, =2.1, =2.0.1, =2.0.1, =2.2, =2.2, =1.2.1, =1.2.1, =1.0.0-alpha-2, =1.0.0-alpha-2, =2.0.0-alpha-2 and more Source cves: CVE-2010-2057 Source advisory: GHSA-4FV4-CQ5V-X45M...

be.novelfaces:novelfaces-components (0.1.0), be.novelfaces:novelfaces-showcase (0.1.0) +41 more potentially affected by CVE-2011-4367 via org.apache.myfaces.core:myfaces-impl (>=2.0.0, <=2.0.11)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.0.0, =2.0, =2.2.2 - com.github.almex:weblets-demo 1.1.3 - org.andromda.timetracker:timetracker-ejb3-web 3.4 - org.apache.geronimo.assemblies:geronimo-jetty8-javaee6 3.0-m1 - org.apache.geronimo.assemblies:geronimo-jetty8-minimal 3.0-m1 -...

net.jakubholy.jeeutils.jsfelcheck:static-jsfexpression-validator-jsf20 (>=0.9.5, <=1.0.0), net.jakubholy.jeeutils.jsfelcheck:test-webapp-jsf20-facelets_owb (>=0.9.6, <=1.0.0) +10 more potentially affected by CVE-2011-4367 via org.apache.myfaces.core:myfaces-impl (>=2.1.0, <=2.1.5)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.1.0, =0.9.5, =0.9.6, =0.9.6, =2.1.0, =2.1.0, =1.0.0-beta-1, =2.0.0, =3.0.0.m1, =4.0.2 Source cves: CVE-2011-4367 Source advisory: OSV:GHSA-GJFX-9WX3-J6R7...

be.novelfaces:novelfaces-components (0.1.0), be.novelfaces:novelfaces-showcase (0.1.0) +41 more potentially affected by CVE-2011-4367 via org.apache.myfaces.core:myfaces-impl (>=2.0.0, <=2.0.11)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.0.0, =2.0, =2.2.2 - com.github.almex:weblets-demo 1.1.3 - org.andromda.timetracker:timetracker-ejb3-web 3.4 - org.apache.geronimo.assemblies:geronimo-jetty8-javaee6 3.0-m1 - org.apache.geronimo.assemblies:geronimo-jetty8-minimal 3.0-m1 -...

net.jakubholy.jeeutils.jsfelcheck:static-jsfexpression-validator-jsf20 (>=0.9.5, <=1.0.0), net.jakubholy.jeeutils.jsfelcheck:test-webapp-jsf20-facelets_owb (>=0.9.6, <=1.0.0) +10 more potentially affected by CVE-2011-4367 via org.apache.myfaces.core:myfaces-impl (>=2.1.0, <=2.1.5)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.1.0, =0.9.5, =0.9.6, =0.9.6, =2.1.0, =2.1.0, =1.0.0-beta-1, =2.0.0, =3.0.0.m1, =4.0.2 Source cves: CVE-2011-4367 Source advisory: GHSA-GJFX-9WX3-J6R7...

Insecure Anti-CSRF Tokens

myfaces-impl uses an insecure cryptographic random for anti-CSRF tokens. The usage of the insecure tokens would allow an attacker to predict subsequent anti-CSRF token values and successfully perform requests on behalf of the users...

be.novelfaces:novelfaces-components (0.1.0), be.novelfaces:novelfaces-showcase (0.1.0) +41 more potentially affected by CVE-2011-4367 via org.apache.myfaces.core:myfaces-impl (>=2.0.0, <=2.0.11)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.0.0, =2.0, =2.2.2 - com.github.almex:weblets-demo 1.1.3 - org.andromda.timetracker:timetracker-ejb3-web 3.4 - org.apache.geronimo.assemblies:geronimo-jetty8-javaee6 3.0-m1 - org.apache.geronimo.assemblies:geronimo-jetty8-minimal 3.0-m1 -...