omnifaces CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH omnifaces CVE published 2026-07-24

CVE-2026-102695

The CVE-2026-102695 vulnerability in OmniFaces allows attackers to forge combined-resource IDs, potentially leading to server-side request forgery, unauthorized resource access, and information disclosure. This issue arises from the lack of authenticity checks on path-derived IDs, which can be inflated without output limits and converted to attacker-selected resource identifiers. Affected versions include [truncated]