CX
Product
Cxf
80
CVEs
0
On KEV
9.8
Max CVSS
11
New 30D
Severity mix
Critical 19High 31Medium 15Low 0
Watch
Add Cxf to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-68079 | 9.8 | Aug 6 | Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay Affected: before 3.6.12; 4.0.0 before 4.1.8; 4.2.0 before 4.2.3 |
| CVE-2026-66909 | 9.8 | Aug 6 | Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage Affected: before 3.6.12; 4.0.0 before 4.1.8; 4.2.0 before 4.2.3 |
| CVE-2026-50628 | 9.8 | Jun 12 | Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control Affected: before 4.1.7; 4.2.0 before 4.2.2 |
| CVE-2026-49875 | 9.8 | Jun 12 | Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils Affected: before 4.1.7; 4.2.0 before 4.2.2 |
| CVE-2026-44930 | 9.8 | May 22 | Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository Affected: before 3.6.11; 4.0.0 before 4.1.6; 4.2.0 |
| CVE-2025-48913 | 9.8 | Aug 8 | If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities Affected: before 3.6.8; 4.0.0 before 4.0.9; 4.1.0 before 4.1.3 |
| CVE-2022-46364 | 9.8 | Dec 13 | A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style… Affected: before 3.4.10; 3.5.0 before 3.5.5 |
| CVE-2019-12419 | 9.8 | Nov 6 | Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service Affected: 3.2.0 before 3.2.11; 3.3.0 before 3.3.4 |
| CVE-2012-0803 | 9.8 | Aug 8 | The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request Affected: 2.4.5; 2.5.1 |
| CVE-2010-2076 | 9.8 | Aug 19 | Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other… Affected: 2.0.6 before 2.0.13; 2.1 before 2.1.10; 2.2.0 before 2.2.9 |
| CVE-2024-28752 | 9.3 | Mar 15 | A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take… Affected: before 3.5.8; 3.6.0 before 3.6.3; 4.0.0 before 4.0.4 |
| CVE-2026-107938 | 9.1 | Oct 9 | Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. Affected: before 3.6.13; 4.0.0 before 4.1.9; 4.2.0 before 4.2.4 |
| CVE-2026-97468 | 9.1 | Oct 9 | Apache CXF: Authentication bypass via weak cache keys for validated STS tokens Affected: before 3.6.13; 4.0.0 before 4.1.9; 4.2.0 before 4.2.4 |
| CVE-2026-71575 | 9.1 | Oct 9 | Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter Affected: before 3.6.13; 4.0.0 before 4.1.9; 4.2.0 before 4.2.4 |
| CVE-2026-61466 | 9.1 | Aug 6 | Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation Affected: before 3.6.12; 4.0.0 before 4.1.8; 4.2.0 before 4.2.3 |
| CVE-2026-63687 | 9.1 | Aug 6 | Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters Affected: before 3.6.12; 4.0.0 before 4.1.8; 4.2.0 before 4.2.3 |
| CVE-2026-65583 | 9.1 | Aug 6 | Apache CXF: Self-issued ID token claims validation skipped Affected: before 3.6.12; 4.0.0 before 4.1.8; 4.2.0 before 4.2.3 |
| CVE-2026-50627 | 9.1 | Jun 12 | Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator Affected: before 4.1.7; 4.2.0 before 4.2.2 |
| CVE-2024-29736 | 9.1 | Jul 19 | A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices Affected: before 3.5.9; 3.6.0 before 3.6.4; 4.0.0 before 4.0.5 |
Showing 19