Eclipse Foundation Eclipse Mojarra

• CVE-2026-120421 Medium 6.1 Reflected XSS via client window id in URL client window mode 0.2%
• CVE-2026-46581 High 7.5 In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet whi 0.6%