Vulnerability Directory
If you’re currently using these frameworks in your application’s tech stack, your application could be vulnerable.
Secure drop-in replacements for open source software from HeroDevs helps you stay secure, compliant, and compatible while you migrate.
Switch to Never-Ending Support (NES) from HeroDevs to immediately mitigate these vulnerabilities.
Severity
ID
Technology
Libraries Affected
Category
Version(s) Affected
Published Date
Medium
Apache CXF
Apache CXF
Log Injection
>=3.1.7 <3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
Oct 1, 2026
Critical
Apache CXF
Apache CXF
Authorization Bypass
<3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
Oct 1, 2026
Medium
Apache CXF
Apache CXF
Content Spoofing
<3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
Oct 1, 2026
High
Apache CXF
Apache CXF
Denial of Service
<3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
Oct 1, 2026
Critical
Apache CXF
Apache CXF
Authorization Bypass
>=3.1.8 <3.6.12, >=4.0.0 <4.1.8, >=4.2.0 <4.2.3
Oct 1, 2026
Critical
Apache CXF
Apache CXF
Improper Restriction of XML External Entity Reference
<3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
Oct 1, 2026
High
Apache CXF
cxf-integration-jca
Remote Code Execution
<3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
Oct 1, 2026
High
.NET
NHibernate
SQL Injection
NHibernate < 5.4.9; NHibernate >= 5.5.0, < 5.5.2
Sep 30, 2026
High
Apache CXF
org.apache.cxf:cxf-rt-rs-service-description
Server-Side Request Forgery
<3.5.9, >=3.6.0 <3.6.4, >=4.0.0 <4.0.5
Sep 29, 2026
High
Apache CXF
Apache CXF (org.apache.cxf:cxf-rt-transports-jms)
Remote Code Execution
<3.6.12, >=4.0.0 <4.1.7, >=4.2.0 <4.2.2
Sep 29, 2026
Critical
Apache CXF
org.apache.cxf:cxf-rt-transports-jms
Remote Code Execution
<3.6.8, >=4.0.0 <4.0.9, >=4.1.0 <4.1.3
Sep 29, 2026
High
Angular
Angular
Denial of Service
>=5.0.0-beta.6 <=19.2.25, >=20.0.0 <20.3.31, >=21.0.0 <21.2.23, >=22.0.0 <22.1.6
Sep 29, 2026
High
Jackson
jackson-databind
Denial of Service
com.fasterxml.jackson.core:jackson-databind: >=2.5.0 <=2.18.10, >=2.19.0 <=2.21.6, >=2.22.0 <=2.22.2; tools.jackson.core:jackson-databind: >=3.0.0 <=3.1.6, >=3.2.0 <=3.2.2
Sep 28, 2026
No results found
Please enter a valid Vulnerability ID number or Technology name.