org.apache.cxf.systests:cxf-systests-jaxrs (4.2.0), org.apache.cxf.systests:cxf-systests-transport-jms (4.2.0) +4 more potentially affected by CVE-2025-48913 +1 more via org.apache.cxf:cxf-rt-transports-jms (4.2.0)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs 4.2.0 -...

org.apache.cxf.systests:cxf-systests-jaxrs (4.2.0), org.apache.cxf.systests:cxf-systests-transport-jms (4.2.0) +4 more potentially affected by CVE-2026-44417 via org.apache.cxf:cxf-rt-transports-jms (4.2.0)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs 4.2.0 -...

org.apache.cxf.systests:cxf-systests-jaxrs (2.3.11), org.apache.cxf.systests:cxf-systests-transports (2.3.11) +4 more potentially affected by CVE-2026-44417 via org.apache.cxf:cxf-rt-transports-jms (2.3.11)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 2.3.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs 2.3.11 -...

org.apache.cxf.systests:cxf-systests-jaxrs (2.5.8), org.apache.cxf.systests:cxf-systests-transport-jms (2.5.8) +5 more potentially affected by CVE-2026-44417 via org.apache.cxf:cxf-rt-transports-jms (2.5.8)

org.apache.cxf:cxf-rt-transports-jms MAVEN version 2.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs 2.5.8 -...

org.apache.cxf:apache-cxf (>=4.0.0, <=4.1.5), org.apache.cxf:cxf-distribution-javadoc (>=4.0.0, <=4.1.5) potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=4.0.0, <=4.1.5)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.1.5 Source cves: CVE-2026-44618 Source advisory: SNYK:JAVA-ORGAPACHECXF-17115402...

org.apache.cxf:apache-cxf (4.2.0), org.apache.cxf:cxf-distribution-javadoc (4.2.0) potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (4.2.0)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-ws-transfer and may be impacted: - org.apache.cxf:apache-cxf 4.2.0 - org.apache.cxf:cxf-distribution-javadoc 4.2.0 Source cves:...

com.github.vindell:spring-boot-starter-cxf-jaxws-plus (>=1.0.0.release, <=1.0.2.release), org.apache.cxf:apache-cxf (>=3.3.0, <=3.6.10) +1 more potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=3.2.4, <=3.6.10)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =3.2.4, =1.0.0.release, =3.3.0, =3.4.0, =3.6.10 Source cves: CVE-2026-44618 Source advisory: SNYK:JAVA-ORGAPACHECXF-17115402...

CVE-2026-44618 Apache CXF: XXE vulnerability in WS-Transfer functionality

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

CVE-2026-44618

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

CVE-2026-44618 Apache CXF: XXE vulnerability in WS-Transfer functionality

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

CVE-2026-44618 Apache CXF: XXE vulnerability in WS-Transfer functionality

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

CVE-2026-44618

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

org.apache.cxf:apache-cxf (>=4.0.0, <=4.1.5), org.apache.cxf:cxf-distribution-javadoc (>=4.0.0, <=4.1.5) potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=4.0.0, <=4.1.5)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.1.5 Source cves: CVE-2026-44618 Source advisory: MEND:CVE-2026-44618...

com.github.vindell:spring-boot-starter-cxf-jaxws-plus (>=1.0.0.release, <=1.0.2.release), org.apache.cxf:apache-cxf (>=3.3.0, <=3.6.10) +1 more potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=3.2.4, <=3.6.10)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =3.2.4, =1.0.0.release, =3.3.0, =3.4.0, =3.6.10 Source cves: CVE-2026-44618 Source advisory: MEND:CVE-2026-44618...

org.apache.cxf:apache-cxf (4.2.0), org.apache.cxf:cxf-distribution-javadoc (4.2.0) potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (4.2.0)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-ws-transfer and may be impacted: - org.apache.cxf:apache-cxf 4.2.0 - org.apache.cxf:cxf-distribution-javadoc 4.2.0 Source cves:...

CVE-2026-44618: Improper Restriction of XML External Entity Reference

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

PT-2026-42754

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.1 Apache CXF versions prior to 4.1.6 Apache CXF versions prior to 3.6.11 Description Insecure XML parser configuration in the WS-Transfer module may allow attackers to perform XML External Entity XXE attacks. X...

WS-2020-0163

marked before 1.1.1 is vulnerable to Regular Expression Denial of Service REDoS. rules.js have multiple unused capture groups which can lead to a Denial of Service...

WS-2017-0421

Denial of Service vulnerability was found in ws npm package 0.2.6 through 1.1.4 and 2.0.0 through 3.3.0. ws can crash when a specially crafted Sec-WebSocket-Extensions header containing Object.prototype property names as extension or parameter names are sent...

br.gov.frameworkdemoiselle.component:demoiselle-report (>=2.0.5, <=2.2.0), net.sourceforge.dynamicreports:dynamicreports-core (>=2.1.0, <=2.2.0) +7 more potentially affected by CVE-2026-6009 via net.sf.jasperreports:jasperreports (4.0.1)

net.sf.jasperreports:jasperreports MAVEN version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.sf.jasperreports:jasperreports and may be impacted: - br.gov.frameworkdemoiselle.component:demoiselle-report =2.0.5, =2.1.0, =2.0, =2.0, =2.0,...