Login Request a demo
AC
Product
Apache CXF
by Apache Software Foundation · last CVE Oct 9, 2026
37
CVEs
0
On KEV
9.8
Max CVSS
11
New 30D
Vulnerabilities37In the news0Timeline
Severity mix
Critical 12High 19Medium 6Low 0
Severity
All severities37Critical12High19Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache CXF to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-50634
6.5
0%
Jun 12
Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry
Affected: 4.2.0 before 4.2.2; 4.0.0 before 4.1.7; before 3.6.12
CVE-2026-50630
6.5
0%
Jun 12
Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection
Affected: 4.2.0 before 4.2.2; 4.0.0 before 4.1.7; before 3.6.12
CVE-2026-79650
6.1
0%
Oct 9
Apache CXF: OIDC RP Open Redirect
Affected: 4.2.0 before 4.2.4; 4.0.0 before 4.1.9; before 3.6.13
CVE-2026-50629
5.3
0%
Jun 12
Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier
Affected: 4.2.0 before 4.2.2; 4.0.0 before 4.1.7; before 3.6.12
CVE-2026-44618
5.3
0%
May 22
Apache CXF: XXE vulnerability in WS-Transfer functionality
Affected: 4.2.0 before 4.2.1; 4.0.0 before 4.1.6; before 3.6.11
CVE-2026-50623
4.8
0%
Jun 12
Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
Affected: 4.2.0 before 4.2.2; 4.0.0 before 4.1.7; before 3.6.12
Showing 6