com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), io.camelbee:camelbee-quarkus-core (3.2.1) +52 more potentially affected by CVE-2026-97791 via org.apache.cxf:cxf-rt-ws-security (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-ws-security MAVEN version =4.2.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.0.0.beta1 and more Source cves: CVE-2026-97791 Source advisory: MEND:CVE-2026-97791...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +299 more potentially affected by CVE-2026-97791 via org.apache.cxf:cxf-rt-ws-security (>=3.0.0-milestone1, <=3.6.12)

org.apache.cxf:cxf-rt-ws-security MAVEN version =3.0.0-milestone1, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.0.0, =1.2.0, =1.4.0, =4.2.0.1, =1.7.2.230613, =1.7.3.230802 and more Source cves: CVE-2026-97791 Source advisory: MEND:CVE-2026-97791...

com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0), de.governikus.panstar.sdk:panstar-soap-sdk (>=4.1.0, <=4.2.0) +85 more potentially affected by CVE-2026-97791 via org.apache.cxf:cxf-rt-ws-security (>=4.1.0, <=4.1.8)

org.apache.cxf:cxf-rt-ws-security MAVEN version =4.1.0, =1.0.0, =4.1.0, =2.5.0, =1.3, =1.3, =1.3, =1.3, =1.3, =3.18.0, =3.18.0, =3.18.0, =3.18.0, =3.18.0, =3.18.0, =3.18.0, =3.33.14 and more Source cves: CVE-2026-97791 Source advisory: MEND:CVE-2026-97791...

br.com.esec.icpm:certillion-client-library (>=1.1.7, <=1.2.0), br.com.esec.icpm:certillion-client-library-resteasy-plugin (>=1.1.9, <=1.1.10) +364 more potentially affected by CVE-2026-97468 via org.apache.cxf:cxf-rt-ws-security (>=2.1.10, <=3.6.12)

org.apache.cxf:cxf-rt-ws-security MAVEN version =2.1.10, =1.1.7, =1.1.9, =1.2.5, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.0.0, =1.0.2, =1.0.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-97468 Source advisory: MEND:CVE-2026-97468...

com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0), cv.igrp:igrp-core (>=2.0.0.231123-rc1, <=2.0.0.240307-rc2) +115 more potentially affected by CVE-2026-97468 via org.apache.cxf:cxf-rt-ws-security (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-rt-ws-security MAVEN version =4.0.0, =1.0.0, =2.0.0.231123-rc1, =4.0.2, =2.4.0, =1.3, =1.3, =1.3, =1.3, =1.3, =2.0.0.alpha1, =2.7.0.cr1, =3.8.0, =2.0.0.alpha1, =2.2.4, =3.33.14 - io.quarkiverse.cxf:quarkus-cxf-integration-test-ws-security-policy-fips 3.8.1 and more Source cves:...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), io.camelbee:camelbee-quarkus-core (3.2.1) +52 more potentially affected by CVE-2026-97468 via org.apache.cxf:cxf-rt-ws-security (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-ws-security MAVEN version =4.2.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.0.0.beta1 and more Source cves: CVE-2026-97468 Source advisory: MEND:CVE-2026-97468...

CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

DEBIAN-CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

UBUNTU-CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

com.genexus:gamutils (>=4.12.0, <=4.14.5), com.genexus:gxawsserverless (>=4.12.0, <=4.14.5) +199 more potentially affected by CVE-2026-95616 via org.apache.wss4j:wss4j-ws-security-common (>=3.0.0, <=3.0.5)

org.apache.wss4j:wss4j-ws-security-common MAVEN version =3.0.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.14.5 and more Source cves: CVE-2026-95616 Source advisory: MEND:CVE-2026-95616...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +507 more potentially affected by CVE-2026-95616 via org.apache.wss4j:wss4j-ws-security-common (>=2.0.0, <=2.4.3)

org.apache.wss4j:wss4j-ws-security-common MAVEN version =2.0.0, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.0.0, =6.2.12, =2.2.4, =2.2.4, =2.2.4, =4.11.0, =4.11.0, =4.11.0, =4.11.2 and more Source cves: CVE-2026-95616 Source advisory: MEND:CVE-2026-95616...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0) +158 more potentially affected by CVE-2026-95616 via org.apache.wss4j:wss4j-ws-security-common (>=4.0.0, <=4.0.1)

org.apache.wss4j:wss4j-ws-security-common MAVEN version =4.0.0, =1.0.0, =0.9.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.4.0, =4.0.0, =4.0.0, =4.0.0, =4.0.2, =4.0.2, =4.7.0 and more Source cves: CVE-2026-95616 Source advisory: MEND:CVE-2026-95616...

DEBIAN-CVE-2026-85532

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...

CVE-2026-85532

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...

CVE-2026-85532

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +281 more potentially affected by CVE-2026-92899 via org.apache.wss4j:wss4j-ws-security-stax (>=2.0.0, <=2.4.3)

org.apache.wss4j:wss4j-ws-security-stax MAVEN version =2.0.0, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.2.0, =1.4.0, =4.2.0.1, =1.7.2.230613, =1.7.2.230622, =1.7.3.230802 and more Source cves: CVE-2026-92899 Source advisory: MEND:CVE-2026-92899...

com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0), io.bitbucket.dsmoons:odk-test-framework (>=2.5.1, <=2.5.2) +86 more potentially affected by CVE-2026-92899 via org.apache.wss4j:wss4j-ws-security-stax (>=4.0.0, <=4.0.1)

org.apache.wss4j:wss4j-ws-security-stax MAVEN version =4.0.0, =1.0.0, =2.5.1, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =1.3, =1.3, =1.3, =1.5.0 and more Source cves: CVE-2026-92899 Source advisory:...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +487 more potentially affected by CVE-2026-92899 via org.apache.wss4j:wss4j-ws-security-dom (>=2.0.0, <=2.4.3)

org.apache.wss4j:wss4j-ws-security-dom MAVEN version =2.0.0, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.0.0, =6.2.12, =2.2.4, =2.2.4, =2.2.4, =4.11.0, =4.11.0, =4.11.0, =4.11.2 and more Source cves: CVE-2026-92899 Source advisory: MEND:CVE-2026-92899...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0) +146 more potentially affected by CVE-2026-92899 via org.apache.wss4j:wss4j-ws-security-dom (>=4.0.0, <=4.0.1)

org.apache.wss4j:wss4j-ws-security-dom MAVEN version =4.0.0, =1.0.0, =0.9.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.4.0, =4.0.0, =4.0.0, =4.0.0, =4.0.2, =4.0.2, =4.7.0 and more Source cves: CVE-2026-92899 Source advisory: MEND:CVE-2026-92899...