com.genexus:gamutils (>=4.12.0, <=4.14.5), com.genexus:gxawsserverless (>=4.12.0, <=4.14.5) +204 more potentially affected by CVE-2026-92899 via org.apache.wss4j:wss4j-ws-security-dom (>=3.0.0, <=3.0.5)

org.apache.wss4j:wss4j-ws-security-dom MAVEN version =3.0.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.14.5 and more Source cves: CVE-2026-92899 Source advisory: MEND:CVE-2026-92899...

com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0), io.bitbucket.dsmoons:odk-test-framework (>=2.5.1, <=2.5.2) +86 more potentially affected by CVE-2026-92899 via org.apache.wss4j:wss4j-ws-security-stax (>=4.0.0, <=4.0.1)

org.apache.wss4j:wss4j-ws-security-stax MAVEN version =4.0.0, =1.0.0, =2.5.1, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =1.3, =1.3, =1.3, =1.5.0 and more Source cves: CVE-2026-92899 Source advisory:...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +281 more potentially affected by CVE-2026-92899 via org.apache.wss4j:wss4j-ws-security-stax (>=2.0.0, <=2.4.3)

org.apache.wss4j:wss4j-ws-security-stax MAVEN version =2.0.0, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.2.0, =1.4.0, =4.2.0.1, =1.7.2.230613, =1.7.2.230622, =1.7.3.230802 and more Source cves: CVE-2026-92899 Source advisory: MEND:CVE-2026-92899...

cv.igrp:igrp-core (>=2.0.0.230625-alpha, <=2.0.0.240307-rc2), cv.igrp:igrp-core-war (>=2.0.0.230625-alpha, <=2.0.0.230801-beta) +93 more potentially affected by CVE-2026-92899 via org.apache.wss4j:wss4j-ws-security-stax (>=3.0.0, <=3.0.5)

org.apache.wss4j:wss4j-ws-security-stax MAVEN version =3.0.0, =2.0.0.230625-alpha, =2.0.0.230625-alpha, =4.0.2, =2.4.0, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =2.0.0.alpha1, =2.7.0.cr1, =3.8.0, =2.0.0.alpha1, =2.2.4, =2.0.0.alpha1,...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +487 more potentially affected by CVE-2026-92899 via org.apache.wss4j:wss4j-ws-security-dom (>=2.0.0, <=2.4.3)

org.apache.wss4j:wss4j-ws-security-dom MAVEN version =2.0.0, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.0.0, =6.2.12, =2.2.4, =2.2.4, =2.2.4, =4.11.0, =4.11.0, =4.11.0, =4.11.2 and more Source cves: CVE-2026-92899 Source advisory: MEND:CVE-2026-92899...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0) +144 more potentially affected by CVE-2026-92899 via org.apache.wss4j:wss4j-ws-security-dom (>=4.0.0, <=4.0.1)

org.apache.wss4j:wss4j-ws-security-dom MAVEN version =4.0.0, =1.0.0, =0.9.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.4.0, =4.0.0, =4.0.0, =4.0.0, =4.0.2, =4.0.2, =4.7.0 and more Source cves: CVE-2026-92899 Source advisory: MEND:CVE-2026-92899...

CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

CVE-2026-92121 Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0), io.bitbucket.dsmoons:odk-test-framework (>=2.5.1, <=2.5.2) +86 more potentially affected by CVE-2026-92121 via org.apache.wss4j:wss4j-ws-security-stax (>=4.0.0, <=4.0.1)

org.apache.wss4j:wss4j-ws-security-stax MAVEN version =4.0.0, =1.0.0, =2.5.1, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =1.3, =1.3, =1.3, =1.5.0 and more Source cves: CVE-2026-92121 Source advisory:...

cv.igrp:igrp-core (>=2.0.0.230625-alpha, <=2.0.0.240307-rc2), cv.igrp:igrp-core-war (>=2.0.0.230625-alpha, <=2.0.0.230801-beta) +93 more potentially affected by CVE-2026-92121 via org.apache.wss4j:wss4j-ws-security-stax (>=3.0.0, <=3.0.5)

org.apache.wss4j:wss4j-ws-security-stax MAVEN version =3.0.0, =2.0.0.230625-alpha, =2.0.0.230625-alpha, =4.0.2, =2.4.0, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =2.0.0.alpha1, =2.7.0.cr1, =3.8.0, =2.0.0.alpha1, =2.2.4, =2.0.0.alpha1,...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +281 more potentially affected by CVE-2026-92121 via org.apache.wss4j:wss4j-ws-security-stax (>=2.0.0, <=2.4.3)

org.apache.wss4j:wss4j-ws-security-stax MAVEN version =2.0.0, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.2.0, =1.4.0, =4.2.0.1, =1.7.2.230613, =1.7.2.230622, =1.7.3.230802 and more Source cves: CVE-2026-92121 Source advisory: MEND:CVE-2026-92121...

EUVD-2026-89795

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0) +144 more potentially affected by CVE-2026-89238 via org.apache.wss4j:wss4j-ws-security-dom (>=4.0.0, <=4.0.1)

org.apache.wss4j:wss4j-ws-security-dom MAVEN version =4.0.0, =1.0.0, =0.9.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.4.0, =4.0.0, =4.0.0, =4.0.0, =4.0.2, =4.0.2, =4.7.0 and more Source cves: CVE-2026-89238 Source advisory: MEND:CVE-2026-89238...

com.genexus:gamutils (>=4.12.0, <=4.14.5), com.genexus:gxawsserverless (>=4.12.0, <=4.14.5) +204 more potentially affected by CVE-2026-89238 via org.apache.wss4j:wss4j-ws-security-dom (>=3.0.0, <=3.0.5)

org.apache.wss4j:wss4j-ws-security-dom MAVEN version =3.0.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.14.5 and more Source cves: CVE-2026-89238 Source advisory: MEND:CVE-2026-89238...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +487 more potentially affected by CVE-2026-89238 via org.apache.wss4j:wss4j-ws-security-dom (>=2.0.0, <=2.4.3)

org.apache.wss4j:wss4j-ws-security-dom MAVEN version =2.0.0, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.0.0, =6.2.12, =2.2.4, =2.2.4, =2.2.4, =4.11.0, =4.11.0, =4.11.0, =4.11.2 and more Source cves: CVE-2026-89238 Source advisory: MEND:CVE-2026-89238...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0) +144 more potentially affected by CVE-2026-88920 via org.apache.wss4j:wss4j-ws-security-dom (>=4.0.0, <=4.0.1)

org.apache.wss4j:wss4j-ws-security-dom MAVEN version =4.0.0, =1.0.0, =0.9.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.4.0, =4.0.0, =4.0.0, =4.0.0, =4.0.2, =4.0.2, =4.7.0 and more Source cves: CVE-2026-88920 Source advisory: MEND:CVE-2026-88920...

com.genexus:gamutils (>=4.12.0, <=4.14.5), com.genexus:gxawsserverless (>=4.12.0, <=4.14.5) +204 more potentially affected by CVE-2026-88920 via org.apache.wss4j:wss4j-ws-security-dom (>=3.0.0, <=3.0.5)

org.apache.wss4j:wss4j-ws-security-dom MAVEN version =3.0.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.14.5 and more Source cves: CVE-2026-88920 Source advisory: MEND:CVE-2026-88920...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +487 more potentially affected by CVE-2026-88920 via org.apache.wss4j:wss4j-ws-security-dom (>=2.0.0, <=2.4.3)

org.apache.wss4j:wss4j-ws-security-dom MAVEN version =2.0.0, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.0.0, =6.2.12, =2.2.4, =2.2.4, =2.2.4, =4.11.0, =4.11.0, =4.11.0, =4.11.2 and more Source cves: CVE-2026-88920 Source advisory: MEND:CVE-2026-88920...

CVE-2026-87830 Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...

CVE-2026-87830 Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...