edu.internet2.middleware.grouper:grouper-ui (>=6.0.0, <=6.4.0), edu.internet2.middleware.grouper:grouper-ws (>=6.0.0, <=6.4.0) potentially affected by CVE-2026-103470 via edu.internet2.middleware.grouper:grouper (>=6.0.0, <=6.4.0)

edu.internet2.middleware.grouper:grouper MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.4.0 Source cves: CVE-2026-103470 Source advisory: MEND:CVE-2026-103470...

edu.internet2.middleware.grouper:grouper-ui (>=7.0.0, <=7.5.0), edu.internet2.middleware.grouper:grouper-ws (>=7.0.0, <=7.5.0) potentially affected by CVE-2026-103470 via edu.internet2.middleware.grouper:grouper (>=7.0.0, <=7.5.0)

edu.internet2.middleware.grouper:grouper MAVEN version =7.0.0, =7.0.0, =7.0.0, =7.5.0 Source cves: CVE-2026-103470 Source advisory: MEND:CVE-2026-103470...

CLSA-2026-1790776603 TuxCare security update for ws (2 CVEs)

TuxCare rebuilt ws to address 2 CVEs. Fixed in 7.5.3-tuxcare.1...

Improper Validation of Specified Index, Position, or Offset in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input through the DerivedKeyTokenInputHandler and DerivedKeyUtils.deriveKey in its StAX and common derived-key processing. An attacker can send a crafted WS-Security message...

Improper Validation of Specified Index, Position, or Offset in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input through the DerivedKeyTokenInputHandler and DerivedKeyUtils.deriveKey in its StAX and common derived-key processing. An attacker can send a crafted WS-Security message...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via XPath conversion in PolicyUtils and matching in SignedElementsAssertionState and related element assertion states in the StAX WS-SecurityPolicy validator. A remote SOAP peer can send ...

DEBIAN-CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

UBUNTU-CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0) +156 more potentially affected by CVE-2026-95616 via org.apache.wss4j:wss4j-ws-security-common (>=4.0.0, <=4.0.1)

org.apache.wss4j:wss4j-ws-security-common MAVEN version =4.0.0, =1.0.0, =0.9.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.4.0, =4.0.0, =4.0.0, =4.0.0, =4.0.2, =4.0.2, =4.7.0 and more Source cves: CVE-2026-95616 Source advisory: MEND:CVE-2026-95616...

com.genexus:gamutils (>=4.12.0, <=4.14.5), com.genexus:gxawsserverless (>=4.12.0, <=4.14.5) +199 more potentially affected by CVE-2026-95616 via org.apache.wss4j:wss4j-ws-security-common (>=3.0.0, <=3.0.5)

org.apache.wss4j:wss4j-ws-security-common MAVEN version =3.0.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.14.5 and more Source cves: CVE-2026-95616 Source advisory: MEND:CVE-2026-95616...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +507 more potentially affected by CVE-2026-95616 via org.apache.wss4j:wss4j-ws-security-common (>=2.0.0, <=2.4.3)

org.apache.wss4j:wss4j-ws-security-common MAVEN version =2.0.0, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.0.0, =6.2.12, =2.2.4, =2.2.4, =2.2.4, =4.11.0, =4.11.0, =4.11.0, =4.11.2 and more Source cves: CVE-2026-95616 Source advisory: MEND:CVE-2026-95616...

DEBIAN-CVE-2026-87830

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...

CVE-2026-87830

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...

DEBIAN-CVE-2026-85532

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...

CVE-2026-85532

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...

CVE-2026-87830

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...

UBUNTU-CVE-2026-87830

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...

CVE-2026-85532

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...