How many CVEs have a located fix in xwiki/xwiki-platform?

139 published CVEs have a fix traced to functions in xwiki/xwiki-platform, touching 486 functions across 327 files.

Which function in xwiki/xwiki-platform has been patched by the most CVEs?

getModifications in xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/ModificationsResourceImpl.java has been changed by 3 CVE fixes, from 2022 to 2025.

How large is a typical CVE fix in xwiki/xwiki-platform?

The median fix changes 36 lines. 37% of fixes change 20 lines or fewer, and 32% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

java

template

#22 of 500 repositories

xwiki/xwiki-platform

Name: xwiki/xwiki-platform: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 15, 2026

139

CVE fixes located

Published CVEs

486

Functions patched

Distinct function sites

327

Files patched

Distinct source files

2007–2026

Years covered

By CVE publication date

Overview

139 published CVEs have a fix traced to functions in xwiki/xwiki-platform, the earliest published in 2007. Those fixes changed 486 distinct functions across 327 files, in 1,856 patch hunks.

Among the 500 repositories tracked here, xwiki/xwiki-platform ranks #22 by the number of CVEs with a located fix.

Most patched functions

Functions in xwiki/xwiki-platform changed by the most CVE fixes.

Most patched files

Files in xwiki/xwiki-platform changed by the most CVE fixes.

1xwiki-platform-tools/xwiki-platform-tool-configuration-resources/src/main/resources/xwiki.properties.vm7 CVEs · 0 functions
2xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java6 CVEs · 11 functions
3xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/Document.java5 CVEs · 10 functions
4xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/createinline.vm5 CVEs · 1 functions
5xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/api/XWiki.java4 CVEs · 10 functions
6xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/XWikiAction.java4 CVEs · 7 functions
7xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/template/InternalTemplateManager.java4 CVEs · 5 functions
8xwiki-platform-core/xwiki-platform-rendering/xwiki-platform-rendering-macros/xwiki-platform-rendering-macro-context/src/main/java/org/xwiki/rendering/internal/macro/context/ContextMacro.java3 CVEs · 4 functions
9xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/XWikiServletResponse.java3 CVEs · 3 functions
10xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/pages/PageHistoryResourceImpl.java3 CVEs · 3 functions

Fix size

How much code a CVE fix in xwiki/xwiki-platform changes, with backports counted once.

36

Median lines changed

Added plus removed, per CVE

37%

Fixes of 20 lines or fewer

Share of CVE fixes

32%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in xwiki/xwiki-platform, and the functions each fix changed.

XWiki Platform: Privilege escalation from edit to script right through Live Data editing
CVE-2026-53966saveDocument ModelBridge
High · CVSS 7.1
EPSS 0.8%2026-09-15
XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+
CVE-2026-34151renderSkin getTemplateRootPath getSkinResourcePath
High · CVSS 8.2
EPSS 1.1%2026-09-14
XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin
CVE-2026-48047resolveUrlFromMatcher copyResourceFromJAR processCSSfile
Medium · CVSS 5.9
EPSS 0.7%2026-08-07
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
CVE-2026-33137importXAR WikiResourceImpl
Critical · CVSS 9.3
EPSS 0.9%2026-05-20
XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality
CVE-2026-40105
Medium · CVSS 6.5
EPSS 0.8%2026-04-15
XWiki's REST APIs can list all pages/spaces, leading to unavailability
CVE-2026-40104getDBList
Medium · CVSS 6.9
EPSS 0.7%2026-04-15
XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API
CVE-2026-33229getRequest
High · CVSS 8.6
EPSS 1.2%2026-04-08
XWiki Platform affected by click-jacking through CSS injection in comments
CVE-2026-26000isFrontendUrlCheckEnabled getTrustedDomains use
Medium · CVSS 5.3
EPSS 0.4%2026-02-12
XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages
CVE-2026-24128
Medium · CVSS 6.5
EPSS 0.6%2026-01-23
XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis
CVE-2025-66473validateAndGetLimit getDocumentsWithTag getTags
High · CVSS 8.7
EPSS 0.4%2025-12-10
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
CVE-2025-66472display
Medium · CVSS 6.5
EPSS 0.5%2025-12-10
The XWiki Jetty package (XJetty) allows accessing any application file through URL
CVE-2025-55749
High · CVSS 8.7
EPSS 1.5%2025-12-01

Get an alert for each new xwiki/xwiki-platform CVE, with the patched functions and AI-written analysis.

Monitor xwiki-platform CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

openemr/openemr140 CVEs mattermost/mattermost141 CVEs misp/misp142 CVEs apache/tomcat135 CVEs django/django144 CVEs FreeRDP/FreeRDP144 CVEs WWBN/AVideo146 CVEs FFmpeg/FFmpeg129 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in xwiki/xwiki-platform.

How many CVEs have a located fix in xwiki/xwiki-platform?: 139 published CVEs have a fix traced to functions in xwiki/xwiki-platform, touching 486 functions across 327 files.
Which function in xwiki/xwiki-platform has been patched by the most CVEs?: getModifications in xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/ModificationsResourceImpl.java has been changed by 3 CVE fixes, from 2022 to 2025.
How large is a typical CVE fix in xwiki/xwiki-platform?: The median fix changes 36 lines. 37% of fixes change 20 lines or fewer, and 32% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track xwiki/xwiki-platform CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing