Omnifaces vulnerabilities
We track 2 vulnerabilities in Omnifaces products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
2vulnerabilities
0critical
2high
0exploited
8.1average CVSS score
Latest Omnifaces vulnerabilities
- 8.2 High severity
omnifaces: Insufficient Verification of Data Authenticity
OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it
- 8.1 High severity
omnifaces: Improper Neutralization of Special Elements used in an Expression Language Statement
OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Code Execution (RCE). This affects applications that use CDNResourceHandler with a wildcard CDN mapping