287 matches found
CVE-2026-92121
In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...
DEBIAN-CVE-2026-92121
In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...
CVE-2026-92121
In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...
UBUNTU-CVE-2026-92121
In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...
CVE-2026-85532
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...
DEBIAN-CVE-2026-85532
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...
CVE-2026-85532
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...
EUVD-2026-89795
In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...
cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +280 more potentially affected by CVE-2026-87830 via org.apache.wss4j:wss4j-ws-security-policy-stax (>=2.0.0, <=2.4.3)
org.apache.wss4j:wss4j-ws-security-policy-stax MAVEN version =2.0.0, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.2.0, =1.4.0, =4.2.0.1, =1.7.2.230613, =1.7.2.230622, =1.7.3.230802 and more Source cves: CVE-2026-87830 Source advisory: MEND:CVE-2026-87830...
com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0), io.bitbucket.dsmoons:odk-test-framework (>=2.5.1, <=2.5.2) +86 more potentially affected by CVE-2026-87830 via org.apache.wss4j:wss4j-ws-security-policy-stax (>=4.0.0, <=4.0.1)
org.apache.wss4j:wss4j-ws-security-policy-stax MAVEN version =4.0.0, =1.0.0, =2.5.1, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =1.3, =1.3, =1.3, =1.5.0 and more Source cves: CVE-2026-87830 So...
CVE-2026-85532 Apache WSS4J: Insufficient Validation of Derived-Key Parameters
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...
EUVD-2026-89791
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...
PT-2026-103133
In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...
ROOT-APP-MAVEN-CVE-2026-40994 CVE-2026-40994 in org.springframework.ws:spring-ws-security - Patched by Root
Root has patched CVE-2026-40994 in the org.springframework.ws:spring-ws-security package for Root:Maven. Multiple fixed versions available...
CVE-2026-79395
An improper authentication vulnerability in the WS-Security wsse:UsernameToken verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions including...
CVE-2026-79395
An improper authentication vulnerability in the WS-Security wsse:UsernameToken verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions including...
EUVD-2026-76192
An improper authentication vulnerability in the WS-Security wsse:UsernameToken verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions including...
PT-2026-90046
Name of the Vulnerable Software and Affected Versions Xiongmai IP Camera XM530 versions prior to HMT.CM2005-v220608.1837 Description An improper authentication issue exists in the WS-Security wsse:UsernameToken verification routine of the Sofia IPC daemon. This occurs when an account's stored...
CVE-2026-79395
The Xiongmai IP Camera XM530 (firmware HMT.CM2005-v220608.1837 and earlier) is vulnerable to an improper authentication flaw in the Sofia IPC daemon . The vulnerability exists within the WS-Security (wsse:UsernameToken) verification routine, allowing remote attackers to bypass authentication by s...