Important: php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php-soap: php-src: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability CVE-2026-6722 PHP: PHP: Denial of Service via improper handling of signed characters in ctype...

Improper Authorization

org.openidentityplatform.openam, openam-federation-library is vulnerable to Improper Authorization. The vulnerability is due to improper authorization checks in the Liberty Web Services SOAP receiver, which allows an unauthenticated remote attacker to write persistent entries into the Liberty...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the Liberty Web Services SOAP receiver. An attacker can write persistent entries into any user's LDAP entry and the shared root-realm Discovery branch by sending anonymous requests to the relevant endpoint,...

Security Bulletin: IBM WebSphere Application Server is affected by a remote code execution vulnerability (CVE-2026-11536)

Summary IBM WebSphere Application Server is affected by a remote code execution vulnerability in the SOAP/JMX connector. Vulnerability Details CVEID:CVE-2026-11536 DESCRIPTION: IBM WebSphere Application Server is affected by a remote code execution vulnerability in the SOAP/JMX connector...

Oracle E-Business Suite (June 2026 CSPU)

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the June 2026 CSPU advisory. - Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite component: Core. Easily exploitable...

Improper Verification of Cryptographic Signature

Overview CoreWCF.Primitives is a port of the service side of Windows Communication Foundation WCF to .NET Core. The goal of this project is to enable existing WCF services to move to .NET Core. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in...

GHSA-GQV6-PWCG-87R8 CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages

Impact The attacker, with one captured signed SOAP envelope from a victim and no other privileges, can invoke arbitrary operations on the service as the victim principal for the lifetime of the captured signing key. There is no rate limit on replays. The DetectReplays setting on transport-securit...

PT-2026-51080

Name of the Vulnerable Software and Affected Versions CoreWCF versions prior to 1.8.1 CoreWCF versions prior to 1.9.1 Description WS-Security signature verification fails to ensure that the selected ds:Signature covers the expected Security header target. This allows an attacker who has captured ...

PT-2026-56538

Name of the Vulnerable Software and Affected Versions Zeep versions 4.0.0 through 4.3.2 Description In this Python SOAP client, the Settings.forbid external setting is not enforced during the parsing of WSDL or XSD documents. This allows transitive xsd:import, xsd:include, wsdl:import, and lxml...

PHP SoapServer Memory Leak Information Disclosure

The vulnerability of the SoapServer class in the PHP programming language is related to the use of memory after it is freed during the processing of the SOAPPERSISTENCESESSION parameter. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose sensitive information or...

CVE-2026-46927

Vulnerability in the Oracle Receivables product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle Receivables...

CVE-2026-46927: Undefined Security Weakness

Vulnerability in the Oracle Receivables product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle Receivables...

Improper Security Configuration

Spring Web Services is vulnerable to Improper Security Configuration. The vulnerability is due to Wss4jSecurityInterceptor disabling WS-I Basic Security Profile BSP enforcement during inbound WS-Security validation by default, allowing SOAP messages that violate BSP security requirements to be...

PT-2026-50031

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Receivables versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of Oracle Receivables. An unauthenticated attacker with network access via SOAP Simple Object Access...

Linux Distros Unpatched Vulnerability : CVE-2026-40997

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Several Spring WS integration paths with Spring Security could surface detailed account state for example locked or disabled user semantics to remote SOAP clien...

io.camunda.connector:connector-runtime-bundle (>=8.5.17, <=8.5.22), io.camunda.connector:connector-soap (>=8.5.17, <=8.9.0-alpha2) +2 more potentially affected by CVE-2026-40997 via org.springframework.ws:spring-ws-security (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.1.0, =8.5.17, =8.5.17, =8.5.17, =7.3.0-rc2, =7.3.8.3 Source cves: CVE-2026-40997 Source advisory: GHSA-5X25-C2RF-F2JX...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-40997 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-40997 Source advisory: OSV:GHSA-5X25-C2RF-F2JX...

io.camunda.connector:connector-runtime-bundle (>=8.5.17, <=8.5.22), io.camunda.connector:connector-soap (>=8.5.17, <=8.9.0-alpha2) +2 more potentially affected by CVE-2026-40994 via org.springframework.ws:spring-ws-security (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.1.0, =8.5.17, =8.5.17, =8.5.17, =7.3.0-rc2, =7.3.8.3 Source cves: CVE-2026-40994 Source advisory: OSV:GHSA-GG9R-WR4P-W63H...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.8.0-alpha4.1) +7 more potentially affected by CVE-2026-40994 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.0.13)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40994 Source advisory: OSV:GHSA-GG9R-WR4P-W63H...

io.camunda.connector:connector-runtime-bundle (>=8.5.17, <=8.5.22), io.camunda.connector:connector-soap (>=8.5.17, <=8.9.0-alpha2) +2 more potentially affected by CVE-2026-40994 via org.springframework.ws:spring-ws-security (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.1.0, =8.5.17, =8.5.17, =8.5.17, =7.3.0-rc2, =7.3.8.3 Source cves: CVE-2026-40994 Source advisory: GHSA-GG9R-WR4P-W63H...