Login Request a demo
AW
Product
Apache WSS4J
by Apache Software Foundation · last CVE Sep 30, 2026
7
CVEs
0
On KEV
9.8
Max CVSS
7
New 30D
Vulnerabilities7In the news0Timeline
Severity mix
Critical 3High 3Medium 1Low 0
Severity
All severities7Critical3High3Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache WSS4J to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-88920
9.8
1%
Sep 30
Apache WSS4J: SAML Sender-Vouches Authentication Bypass
Affected: 4.0.0 before 4.0.2; 3.0.0 before 3.0.6; before 2.4.4
CVE-2026-89238
9.1
0%
Sep 30
Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection
Affected: 4.0.0 before 4.0.2; 3.0.0 before 3.0.6; before 2.4.4
CVE-2026-87830
9.1
0%
Sep 30
Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.
Affected: 4.0.0 before 4.0.2; 3.0.0 before 3.0.6; before 2.4.4
CVE-2026-95616
7.5
0%
Sep 30
Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions
Affected: 4.0.0 before 4.0.2; 3.0.0 before 3.0.6; before 2.4.4
CVE-2026-92121
7.5
1%
Sep 30
Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference
Affected: 4.0.0 before 4.0.2; 3.0.0 before 3.0.6; before 2.4.4
CVE-2026-85532
7.5
1%
Sep 30
Apache WSS4J: Insufficient Validation of Derived-Key Parameters
Affected: 4.0.0 before 4.0.2; 3.0.0 before 3.0.6; before 2.4.4
CVE-2026-92899
4.8
1%
Sep 30
Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce
Affected: 4.0.0 before 4.0.2; 3.0.0 before 3.0.6; before 2.4.4
Showing 7