org.apache.cxf.systests:cxf-systests-jaxrs (2.6.11), org.apache.cxf.systests:cxf-systests-transport-jms (2.6.11) +6 more potentially affected by CVE-2026-50632 via org.apache.cxf:cxf-rt-transports-jms (2.6.11)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 2.6.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs 2.6.11 -...

org.apache.cxf.systests:cxf-systests-jaxrs (2.4.10), org.apache.cxf.systests:cxf-systests-transport-jms (2.4.10) +5 more potentially affected by CVE-2026-50632 via org.apache.cxf:cxf-rt-transports-jms (2.4.10)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 2.4.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs 2.4.10 -...

org.apache.cxf.systests:cxf-systests-jaxrs (2.6.16), org.apache.cxf.systests:cxf-systests-transport-jms (2.6.16) +6 more potentially affected by CVE-2026-50632 via org.apache.cxf:cxf-rt-transports-jms (2.6.16)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 2.6.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs 2.6.16 -...

org.apache.cxf.systests:cxf-systests-jaxrs (2.4.5), org.apache.cxf.systests:cxf-systests-transport-jms (2.4.5) +5 more potentially affected by CVE-2026-50632 via org.apache.cxf:cxf-rt-transports-jms (2.4.5)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 2.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs 2.4.5 -...

org.apache.camel:camel-example-cxf (>=2.14.0, <=2.19.5), org.apache.cxf.osgi.itests:org.apache.cxf.osgi.itests (>=3.0.0, <=3.6.11) +17 more potentially affected by CVE-2026-50632 via org.apache.cxf:cxf-rt-transports-jms (>=3.0.0-milestone1, <=3.6.11)

org.apache.cxf:cxf-rt-transports-jms MAVEN version =3.0.0-milestone1, =2.14.0, =3.0.0, =3.0.0-milestone1, =3.0.0-milestone1, =3.0.0-milestone1, =3.0.0-milestone1, =3.0.0-milestone1, =3.0.0-milestone1, =3.0.0-milestone1, =3.0.0-milestone1, =3.2.0, =5.0.0.beta1, =5.0.0.beta1, =5.0.0.beta1,...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.8.0-alpha4.1) +7 more potentially affected by CVE-2026-40994 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.0.13)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40994 Source advisory: GHSA-GG9R-WR4P-W63H...

cn.com.mooho:base (1.3.29.8), cn.openapis:hy.microservice (>=1.0.0, <=1.21.0) +75 more potentially affected by CVE-2026-40999 via org.springframework.ws:spring-ws-core (>=3.1.0, <=3.1.8)

org.springframework.ws:spring-ws-core MAVEN version =3.1.0, =1.0.0, =0.0.1, =0.0.1, =3.1.2, =3.1.2, =3.1.2, =3.1.2, =2022.04.001, =2022.04.001, =0.5.02, =0.3.0, =1.0.0, =1.0.2 - de.gematik.ti:vauchannel-client 1.4.0 and more Source cves: CVE-2026-40999 Source advisory: OSV:GHSA-WHPP-XV3H-RWXF...

Spring Web Services: Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default

Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS1 v1.5 rsa-15 encrypted key material unless operators explicitly reconfigured the flag...

Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default

Wss4jSecurityInterceptor initialized its BSP WS-I Basic Security Profile compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +66 more potentially affected by CVE-2026-40999 via org.springframework.ws:spring-ws-core (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-ws-core MAVEN version =4.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-40999 Source advisory: GHSA-WHPP-XV3H-RWXF...

no.difi.meldingsutveksling:altinn-client (>=2.3.0, <=2.3.2), no.difi.meldingsutveksling:api (>=2.3.0, <=2.3.2) +17 more potentially affected by CVE-2026-40996 via org.springframework.ws:spring-ws-security (>=3.1.1, <=3.1.7)

org.springframework.ws:spring-ws-security MAVEN version =3.1.1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.12, =2.18-rc1, =2.18-rc1, =4.0.4 and more Source cves: CVE-2026-40996 Source advisory: GHSA-P7QJ-2Q5W-F9R7...

no.difi.meldingsutveksling:altinn-client (>=2.3.0, <=2.3.2), no.difi.meldingsutveksling:api (>=2.3.0, <=2.3.2) +17 more potentially affected by CVE-2026-40997 via org.springframework.ws:spring-ws-security (>=3.1.1, <=3.1.7)

org.springframework.ws:spring-ws-security MAVEN version =3.1.1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.12, =2.18-rc1, =2.18-rc1, =4.0.4 and more Source cves: CVE-2026-40997 Source advisory: OSV:GHSA-5X25-C2RF-F2JX...

no.difi.meldingsutveksling:altinn-client (>=2.3.0, <=2.3.2), no.difi.meldingsutveksling:api (>=2.3.0, <=2.3.2) +17 more potentially affected by CVE-2026-40995 via org.springframework.ws:spring-ws-security (>=3.1.1, <=3.1.7)

org.springframework.ws:spring-ws-security MAVEN version =3.1.1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.12, =2.18-rc1, =2.18-rc1, =4.0.4 and more Source cves: CVE-2026-40995 Source advisory: OSV:GHSA-6MFM-98WV-32WM...

no.difi.meldingsutveksling:altinn-client (>=2.3.0, <=2.3.2), no.difi.meldingsutveksling:api (>=2.3.0, <=2.3.2) +17 more potentially affected by CVE-2026-41000 via org.springframework.ws:spring-ws-security (>=3.1.1, <=3.1.7)

org.springframework.ws:spring-ws-security MAVEN version =3.1.1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.12, =2.18-rc1, =2.18-rc1, =4.0.4 and more Source cves: CVE-2026-41000 Source advisory: OSV:GHSA-8QQ9-R6CC-QJV9...

no.difi.meldingsutveksling:altinn-client (>=2.3.0, <=2.3.2), no.difi.meldingsutveksling:api (>=2.3.0, <=2.3.2) +17 more potentially affected by CVE-2026-40994 via org.springframework.ws:spring-ws-security (>=3.1.1, <=3.1.7)

org.springframework.ws:spring-ws-security MAVEN version =3.1.1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.12, =2.18-rc1, =2.18-rc1, =4.0.4 and more Source cves: CVE-2026-40994 Source advisory: OSV:GHSA-GG9R-WR4P-W63H...

no.difi.meldingsutveksling:altinn-client (>=2.3.0, <=2.3.2), no.difi.meldingsutveksling:api (>=2.3.0, <=2.3.2) +17 more potentially affected by CVE-2026-40996 via org.springframework.ws:spring-ws-security (>=3.1.1, <=3.1.7)

org.springframework.ws:spring-ws-security MAVEN version =3.1.1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.12, =2.18-rc1, =2.18-rc1, =4.0.4 and more Source cves: CVE-2026-40996 Source advisory: OSV:GHSA-P7QJ-2Q5W-F9R7...

no.difi.meldingsutveksling:altinn-client (>=2.3.0, <=2.3.2), no.difi.meldingsutveksling:api (>=2.3.0, <=2.3.2) +17 more potentially affected by CVE-2026-40997 via org.springframework.ws:spring-ws-security (>=3.1.1, <=3.1.7)

org.springframework.ws:spring-ws-security MAVEN version =3.1.1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.12, =2.18-rc1, =2.18-rc1, =4.0.4 and more Source cves: CVE-2026-40997 Source advisory: GHSA-5X25-C2RF-F2JX...

no.difi.meldingsutveksling:altinn-client (>=2.3.0, <=2.3.2), no.difi.meldingsutveksling:api (>=2.3.0, <=2.3.2) +17 more potentially affected by CVE-2026-40995 via org.springframework.ws:spring-ws-security (>=3.1.1, <=3.1.7)

org.springframework.ws:spring-ws-security MAVEN version =3.1.1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.12, =2.18-rc1, =2.18-rc1, =4.0.4 and more Source cves: CVE-2026-40995 Source advisory: GHSA-6MFM-98WV-32WM...

no.difi.meldingsutveksling:altinn-client (>=2.3.0, <=2.3.2), no.difi.meldingsutveksling:api (>=2.3.0, <=2.3.2) +17 more potentially affected by CVE-2026-41000 via org.springframework.ws:spring-ws-security (>=3.1.1, <=3.1.7)

org.springframework.ws:spring-ws-security MAVEN version =3.1.1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.12, =2.18-rc1, =2.18-rc1, =4.0.4 and more Source cves: CVE-2026-41000 Source advisory: GHSA-8QQ9-R6CC-QJV9...

no.difi.meldingsutveksling:altinn-client (>=2.3.0, <=2.3.2), no.difi.meldingsutveksling:api (>=2.3.0, <=2.3.2) +17 more potentially affected by CVE-2026-40994 via org.springframework.ws:spring-ws-security (>=3.1.1, <=3.1.7)

org.springframework.ws:spring-ws-security MAVEN version =3.1.1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.12, =2.18-rc1, =2.18-rc1, =4.0.4 and more Source cves: CVE-2026-40994 Source advisory: GHSA-GG9R-WR4P-W63H...