Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server Liberty is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty with the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, xmlWS-4.0 or wsAtomicTransaction-1.2 enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty (bundled with IBM Enterprise Application Runtimes) are affected by multiple vulnerabilities due to Apache CXF (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary There are mulitple vulnerabilities in the Apache CXF library that affect IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Enterprise Application Runtimes, when the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, or xmlWS-4.0 features are...

com.github.vindell:spring-boot-starter-cxf-jaxws-plus (>=1.0.0.release, <=1.0.2.release), org.apache.cxf:apache-cxf (>=3.3.0, <=3.6.10) +1 more potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=3.2.4, <=3.6.10)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =3.2.4, =1.0.0.release, =3.3.0, =3.4.0, =3.6.10 Source cves: CVE-2026-44618 Source advisory: OSV:GHSA-VMM5-FJGX-2JHP...

com.github.vindell:spring-boot-starter-cxf-jaxws-plus (>=1.0.0.release, <=1.0.2.release), org.apache.cxf:apache-cxf (>=3.3.0, <=3.6.10) +1 more potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=3.2.4, <=3.6.10)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =3.2.4, =1.0.0.release, =3.3.0, =3.4.0, =3.6.10 Source cves: CVE-2026-44618 Source advisory: GHSA-VMM5-FJGX-2JHP...

com.github.vindell:spring-boot-starter-cxf-jaxws-plus (>=1.0.0.release, <=1.0.2.release), org.apache.cxf:apache-cxf (>=3.3.0, <=3.6.10) +1 more potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=3.2.4, <=3.6.10)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =3.2.4, =1.0.0.release, =3.3.0, =3.4.0, =3.6.10 Source cves: CVE-2026-44618 Source advisory: MEND:CVE-2026-44618...

org.apache.openejb:apache-tomee (1.7.5), org.apache.openejb:arquillian-tomee-codi-tests (1.7.5) +6 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat (7.0.81)

org.apache.tomcat:tomcat MAVEN version 7.0.81 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat and may be impacted: - org.apache.openejb:apache-tomee 1.7.5 - org.apache.openejb:arquillian-tomee-codi-tests 1.7.5 -...

io.undertow:undertow-servlet (1.0.0.beta33), io.undertow:undertow-websockets-jsr (1.0.0.beta33) +2 more potentially affected by CVE-2026-3260 via io.undertow:undertow-core (1.0.0.beta33)

io.undertow:undertow-core MAVEN version 1.0.0.beta33 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta33 - io.undertow:undertow-websockets-jsr 1.0.0.beta33 -...

K000160435: FasterXML jackson-databind vulnerability CVE-2018-14721

Security Advisory Description FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery SSRF attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization. CVE-2018-14721 Impact There is no impact; F5 products a...

io.undertow:undertow-servlet (1.0.0.beta33), io.undertow:undertow-websockets-jsr (1.0.0.beta33) +2 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.0.0.beta33)

io.undertow:undertow-core MAVEN version 1.0.0.beta33 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta33 - io.undertow:undertow-websockets-jsr 1.0.0.beta33 -...

io.undertow:undertow-servlet (1.0.0.beta33), io.undertow:undertow-websockets-jsr (1.0.0.beta33) +2 more potentially affected by CVE-2024-3884 via io.undertow:undertow-core (1.0.0.beta33)

io.undertow:undertow-core MAVEN version 1.0.0.beta33 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta33 - io.undertow:undertow-websockets-jsr 1.0.0.beta33 -...

EUVD-2016-4577

Malware in sbrugna...

io.undertow:undertow-servlet (1.0.0.beta33), io.undertow:undertow-websockets-jsr (1.0.0.beta33) +2 more potentially affected by CVE-2023-4639 via io.undertow:undertow-core (1.0.0.beta33)

io.undertow:undertow-core MAVEN version 1.0.0.beta33 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta33 - io.undertow:undertow-websockets-jsr 1.0.0.beta33 -...

io.undertow:undertow-servlet (1.0.0.beta33), io.undertow:undertow-websockets-jsr (1.0.0.beta33) +2 more potentially affected by CVE-2024-7885 via io.undertow:undertow-core (1.0.0.beta33)

io.undertow:undertow-core MAVEN version 1.0.0.beta33 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta33 - io.undertow:undertow-websockets-jsr 1.0.0.beta33 -...

org.apache.cxf.systests:cxf-systests-databinding (2.6.17), org.apache.cxf.systests:cxf-systests-jaxrs (2.6.17) +9 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.6.17)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.6.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.6.17 -...

net.n2oapp.datastreaming:data-streaming (>=7.3.1, <=7.7.9), org.apache.cxf.systests:cxf-systests-databinding (2.2.12) +9 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.2.12)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.2.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - net.n2oapp.datastreaming:data-streaming =7.3.1, =7.7.9 -...

org.apache.cxf.systests:cxf-systests-databinding (2.6.10), org.apache.cxf.systests:cxf-systests-jaxrs (2.6.10) +9 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.6.10)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.6.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.6.10 -...

org.apache.cxf.systests:cxf-systests-databinding (2.3.6), org.apache.cxf.systests:cxf-systests-jaxrs (2.3.6) +8 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.3.6)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.3.6 -...

org.apache.cxf.systests:cxf-systests-databinding (2.3.3), org.apache.cxf.systests:cxf-systests-jaxrs (2.3.3) +8 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.3.3)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.3.3 -...

org.apache.cxf.systests:cxf-systests-databinding (2.4.5), org.apache.cxf.systests:cxf-systests-jaxrs (2.4.5) +9 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.4.5)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.4.5 -...

org.apache.cxf.systests:cxf-systests-databinding (2.6.12), org.apache.cxf.systests:cxf-systests-jaxrs (2.6.12) +9 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.6.12)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.6.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.6.12 -...