Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Apache CXF 3.6.11, 4.1.6, 4.2.1 Clear all filters
TI-2026-32359 CVE-2026-44417 · GHSA-2hvc-5c6v-f533

Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)

Priority LOW 36

The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to con…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00663 Published 2026-05-22 Partial fix · 4.2.1, 4.1.6 +1 CWE-20
TI-2026-32525 CVE-2026-44618 · GHSA-vmm5-fjgx-2jhp

Apache CXF: XXE vulnerability in WS-Transfer functionality

Priority LOW 24

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00314 Published 2026-05-22 Fixed in 4.2.1, 4.1.6 +1 CWE-611
TI-2026-32796 CVE-2026-44930 · GHSA-pg32-686q-qh6x

Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository

Priority MEDIUM 43

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00719 Published 2026-05-22 Partial fix · 4.2.1, 4.1.6 +1 CWE-90