Threats affecting pkg:maven/org.apache.myfaces/core

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.8	EPSS 0.5%	CVE-2026-68536 · Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core Critical9.8EPSS 0.5%2026-09-16GCVE Database Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue. EPSS 0.5%Report on CVE-2026-68536 Vulnerability CWE-918 #ghsa-5fv6-hxpr-6p55	GCVE Database	2026-09-16
High	7.5	EPSS 0.6%	CVE-2026-76646Apache MyFaces · Uncontrolled Resource Consumption High7.5EPSS 0.6%2026-09-16CVE Database V5CVE-2026-76646 CVE-2026-76646 is a high-severity vulnerability in Apache MyFaces that allows a remote attacker to cause uncontrolled resource consumption by sending specially crafted request parameters. This can lead to a denial of service (DoS) condition. The issue affects multiple versions of Apache MyFaces, and fixed versions have been released. Users are advised to upgrade to the specified fixed versions to mitigate the risk. EPSS 0.6%Vulnerability Apache Software Foundation CWE-400	CVE Database V5	2026-09-16

Page 1 of 1