Vulnerability Directory
If you’re currently using these frameworks in your application’s tech stack, your application could be vulnerable.
Secure drop-in replacements for open source software from HeroDevs helps you stay secure, compliant, and compatible while you migrate.
Switch to Never-Ending Support (NES) from HeroDevs to immediately mitigate these vulnerabilities.
Severity
ID
Technology
Libraries Affected
Category
Version(s) Affected
Published Date
High
Apache CXF
Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2)
Authorization Bypass
<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
Oct 1, 2026
High
Apache CXF
Apache CXF (org.apache.cxf:cxf-core)
Denial of Service
<3.5.10, >=3.6.0 <3.6.5, >=4.0.0 <4.0.6
Oct 1, 2026
Medium
Apache CXF
Apache CXF (org.apache.cxf:cxf-rt-rs-security-jose)
Denial of Service
<3.5.9, >=3.6.0 <3.6.4, >=4.0.0 <4.0.5
Oct 1, 2026
Critical
Apache CXF
org.apache.cxf:cxf-rt-databinding-aegis
Server-Side Request Forgery
<3.5.8, >=3.6.0 <3.6.3, >=4.0.0 <4.0.4
Oct 1, 2026
High
Apache CXF
Apache CXF
Improper Restriction of XML External Entity Reference
<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
Oct 1, 2026
Medium
Apache CXF
cxf-rt-ws-transfer
Improper Restriction of XML External Entity Reference
<3.6.11, >=4.0.0 <4.1.6, >=4.2.0 <4.2.1
Oct 1, 2026
Critical
Apache CXF
org.apache.cxf:cxf-rt-transports-jms
Remote Code Execution
<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
Oct 1, 2026
Medium
Apache CXF
cxf-rt-rs-security-jose-jaxrs
Signature Forgery
>=3.0.3 <3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
Oct 1, 2026
Critical
Apache CXF
Apache CXF
Authorization Bypass
<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
Oct 1, 2026
High
Apache CXF
Apache CXF (org.apache.cxf:cxf-rt-rs-security-oauth2)
Concurrent Execution using Shared Resource with Improper Synchronization
<3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
Oct 1, 2026
High
Apache CXF
Apache CXF
Denial of Service
<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
Oct 1, 2026
High
Apache CXF
org.apache.cxf:cxf-rt-rs-security-sso-oidc
Insufficient Verification of Data Authenticity
<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
Oct 1, 2026
High
Apache CXF
Apache CXF
Denial of Service
<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
Oct 1, 2026
Critical
Apache CXF
Apache CXF
Information Exposure
<3.6.11, >=4.0.0 <4.1.6, >=4.2.0 <4.2.1
Oct 1, 2026
High
Apache CXF
Apache CXF
Denial of Service
<3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
Oct 1, 2026
No results found
Please enter a valid Vulnerability ID number or Technology name.