WS
Product
Wss4j
12
CVEs
0
On KEV
9.8
Max CVSS
7
New 30D
Severity mix
Critical 3High 5Medium 2Low 0
Watch
Add Wss4j to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-88920 | 9.8 | Sep 30 | Apache WSS4J: SAML Sender-Vouches Authentication Bypass Affected: before 2.4.4; 3.0.0 before 3.0.6; 4.0.0 before 4.0.2 |
| CVE-2026-89238 | 9.1 | Sep 30 | Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection Affected: before 2.4.4; 3.0.0 before 3.0.6; 4.0.0 before 4.0.2 |
| CVE-2026-87830 | 9.1 | Sep 30 | Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks. Affected: before 2.4.4; 3.0.0 before 3.0.6; 4.0.0 before 4.0.2 |
| CVE-2020-13936 | 8.8 | Mar 10 | An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet… Affected: 2.3.1 |
| CVE-2026-95616 | 7.5 | Sep 30 | Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions Affected: before 2.4.4; 3.0.0 before 3.0.6; 4.0.0 before 4.0.2 |
| CVE-2026-92121 | 7.5 | Sep 30 | Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference Affected: before 2.4.4; 3.0.0 before 3.0.6; 4.0.0 before 4.0.2 |
| CVE-2026-85532 | 7.5 | Sep 30 | Apache WSS4J: Insufficient Validation of Derived-Key Parameters Affected: before 2.4.4; 3.0.0 before 3.0.6; 4.0.0 before 4.0.2 |
| CVE-2015-0226 | 7.5 | Oct 30 | Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier… Affected: through 1.6.16; 2.0; 2.0.0; 2.0.0; 2.0.1 |
| CVE-2011-2487 | 5.9 | Mar 11 | The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack Affected: before 1.6.5 |
| CVE-2026-92899 | 4.8 | Sep 30 | Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce Affected: before 2.4.4; 3.0.0 before 3.0.6; 4.0.0 before 4.0.2 |
| CVE-2015-0227 | – | Feb 12 | Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks." Affected: through 1.6.16; 2.0.0; 2.0.0; 2.0.1 |
| CVE-2014-3623 | – | Oct 30 | Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML… Affected: before 1.6.17; 2.0.0 before 2.0.2 |
Showing 12