Apache / Apache Cxf
47 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-57818 | Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider | HIGH | 8.1 | Aug 6, 2026 |
| CVE-2026-61466 | Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation | CRITICAL | 9.1 | Aug 6, 2026 |
| CVE-2026-63687 | Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters | CRITICAL | 9.1 | Aug 6, 2026 |
| CVE-2026-65583 | Apache CXF: Self-issued ID token claims validation skipped | CRITICAL | 9.1 | Aug 6, 2026 |
| CVE-2026-68079 | Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay | CRITICAL | 9.8 | Aug 6, 2026 |
| CVE-2026-68481 | Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider | HIGH | 7.5 | Aug 6, 2026 |
| CVE-2026-65432 | Apache CXF: XXE via WSDL/XSD import parsing | HIGH | 7.5 | Aug 6, 2026 |
| CVE-2026-57817 | Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow | HIGH | 8.1 | Aug 6, 2026 |
| CVE-2026-66909 | Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage | CRITICAL | 9.8 | Aug 6, 2026 |
| CVE-2026-64958 | Apache CXF: Denial of service via message header attachments | HIGH | 7.5 | Aug 6, 2026 |
| CVE-2026-57819 | Apache CXF: No default restriction on the amount of form parameters per message | HIGH | 7.5 | Aug 6, 2026 |
| CVE-2026-54225 | Apache CXF: Denial of Service attack via large attachments | HIGH | 7.5 | Aug 6, 2026 |
| CVE-2026-50645 | Apache CXF: No restriction on attachment headers per message | HIGH | 7.5 | Jun 12, 2026 |
| CVE-2026-50634 | Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry | MEDIUM | 6.5 | Jun 12, 2026 |
| CVE-2026-50633 | Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl | CRITICAL | 9.8 | Jun 12, 2026 |
| CVE-2026-50632 | Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory | CRITICAL | 9.8 | Jun 12, 2026 |
| CVE-2026-50631 | Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing | HIGH | 7.4 | Jun 12, 2026 |
| CVE-2026-50630 | Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection | MEDIUM | 6.5 | Jun 12, 2026 |
| CVE-2026-50629 | Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier | HIGH | 8.2 | Jun 12, 2026 |
| CVE-2026-50628 | Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control | CRITICAL | 9.8 | Jun 12, 2026 |
| CVE-2026-50627 | Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator | CRITICAL | 9.1 | Jun 12, 2026 |
| CVE-2026-49875 | Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils | CRITICAL | 9.8 | Jun 12, 2026 |
| CVE-2026-50623 | Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService | MEDIUM | 6.5 | Jun 12, 2026 |
| CVE-2026-44417 | Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE) | HIGH | 7.5 | May 22, 2026 |
| CVE-2026-44618 | Apache CXF: XXE vulnerability in WS-Transfer functionality | MEDIUM | 5.3 | May 22, 2026 |
Showing 1 to 25 of 47 CVEs