Linux Distros Unpatched Vulnerability : CVE-2026-92121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal inside signed content flag permanently set. The...

Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / bea-stax-api / etc Multiple Vulnerabilities (crlba-2019_3416)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlba-20193416 advisory. For detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section. This advisory is provided by...

Linux Distros Unpatched Vulnerability : CVE-2026-87830

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML...

CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

DEBIAN-CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

UBUNTU-CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

CVE-2026-87830

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...

DEBIAN-CVE-2026-87830

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...

CVE-2026-87830

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...

UBUNTU-CVE-2026-87830

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +281 more potentially affected by CVE-2026-92899 via org.apache.wss4j:wss4j-ws-security-stax (>=2.0.0, <=2.4.3)

org.apache.wss4j:wss4j-ws-security-stax MAVEN version =2.0.0, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.2.0, =1.4.0, =4.2.0.1, =1.7.2.230613, =1.7.2.230622, =1.7.3.230802 and more Source cves: CVE-2026-92899 Source advisory: MEND:CVE-2026-92899...

com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0), io.bitbucket.dsmoons:odk-test-framework (>=2.5.1, <=2.5.2) +86 more potentially affected by CVE-2026-92899 via org.apache.wss4j:wss4j-ws-security-stax (>=4.0.0, <=4.0.1)

org.apache.wss4j:wss4j-ws-security-stax MAVEN version =4.0.0, =1.0.0, =2.5.1, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =1.3, =1.3, =1.3, =1.5.0 and more Source cves: CVE-2026-92899 Source advisory:...

cv.igrp:igrp-core (>=2.0.0.230625-alpha, <=2.0.0.240307-rc2), cv.igrp:igrp-core-war (>=2.0.0.230625-alpha, <=2.0.0.230801-beta) +93 more potentially affected by CVE-2026-92899 via org.apache.wss4j:wss4j-ws-security-stax (>=3.0.0, <=3.0.5)

org.apache.wss4j:wss4j-ws-security-stax MAVEN version =3.0.0, =2.0.0.230625-alpha, =2.0.0.230625-alpha, =4.0.2, =2.4.0, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =2.0.0.alpha1, =2.7.0.cr1, =3.8.0, =2.0.0.alpha1, =2.2.4, =2.0.0.alpha1,...

CVE-2026-92121 Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

CVE-2026-92121

The Apache WSS4J library contains a vulnerability in its streaming (StAX) code . A signature reference utilizing the WS-Security STR-Transform causes an internal "inside signed content" flag to remain permanently set. This leads the WS-SecurityPolicy enforcer to stop evaluating SignedParts and Si...

EUVD-2026-89795

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +281 more potentially affected by CVE-2026-92121 via org.apache.wss4j:wss4j-ws-security-stax (>=2.0.0, <=2.4.3)

org.apache.wss4j:wss4j-ws-security-stax MAVEN version =2.0.0, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.2.0, =1.4.0, =4.2.0.1, =1.7.2.230613, =1.7.2.230622, =1.7.3.230802 and more Source cves: CVE-2026-92121 Source advisory: MEND:CVE-2026-92121...

cv.igrp:igrp-core (>=2.0.0.230625-alpha, <=2.0.0.240307-rc2), cv.igrp:igrp-core-war (>=2.0.0.230625-alpha, <=2.0.0.230801-beta) +93 more potentially affected by CVE-2026-92121 via org.apache.wss4j:wss4j-ws-security-stax (>=3.0.0, <=3.0.5)

org.apache.wss4j:wss4j-ws-security-stax MAVEN version =3.0.0, =2.0.0.230625-alpha, =2.0.0.230625-alpha, =4.0.2, =2.4.0, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =2.0.0.alpha1, =2.7.0.cr1, =3.8.0, =2.0.0.alpha1, =2.2.4, =2.0.0.alpha1,...