ai.idylnlp:idylnlp-nlp-language-detection-tika (>=1.0.0, <=1.1.0), ai.mattmann.mnemosyne:cas-crawler (1.11.0) +3410 more potentially affected by CVE-2026-108039 via org.apache.cxf:cxf-core (>=3.0.0-milestone1, <=3.6.12)

org.apache.cxf:cxf-core MAVEN version =3.0.0-milestone1, =1.0.0, =1.11.0, =1.11.0, =1.0.0, =11.4-37, =3.6.1, =3.11.0, =3.19.0 and more Source cves: CVE-2026-108039 Source advisory: SNYK:JAVA-ORGAPACHECXF-21244413...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), com.codbex.atlas:codbex-atlas-application (>=2.98.0, <=2.116.0) +413 more potentially affected by CVE-2026-108039 via org.apache.cxf:cxf-core (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-core MAVEN version =4.2.0, =2.98.0, =4.0.0-beta.1, =4.0.0-beta.1, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.4.0 - de.cezaryrk.olingo:odata-fit 5.1.0 - io.bootique.cxf:bootique-cxf-core 4.0-m6 and more Source cves: CVE-2026-108039 Source advisory:...

Allocation of Resources Without Limits or Throttling

Overview org.apache.cxf:cxf-core is an an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through StaxUtils in...

ai.idylnlp:idylnlp-nlp-language-detection-tika (>=1.0.0, <=1.1.0), ai.mattmann.mnemosyne:cas-crawler (1.11.0) +3410 more potentially affected by CVE-2026-78384 via org.apache.cxf:cxf-core (>=3.0.0-milestone1, <=3.6.12)

org.apache.cxf:cxf-core MAVEN version =3.0.0-milestone1, =1.0.0, =1.11.0, =1.11.0, =1.0.0, =11.4-37, =3.6.1, =3.11.0, =3.19.0 and more Source cves: CVE-2026-78384 Source advisory: SNYK:JAVA-ORGAPACHECXF-20824751...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), com.codbex.atlas:codbex-atlas-application (>=2.98.0, <=2.116.0) +413 more potentially affected by CVE-2026-78384 via org.apache.cxf:cxf-core (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-core MAVEN version =4.2.0, =2.98.0, =4.0.0-beta.1, =4.0.0-beta.1, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.4.0 - de.cezaryrk.olingo:odata-fit 5.1.0 - io.bootique.cxf:bootique-cxf-core 4.0-m6 and more Source cves: CVE-2026-78384 Source advisory:...

be.atbash.test:integration-testing (2.2.0), be.atbash.test:integration-testing-database (2.2.0) +897 more potentially affected by CVE-2026-108039 via org.apache.cxf:cxf-core (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-core MAVEN version =4.0.0, =1.0.0, =12.1-7-21, =0.0.1, =1.1.0, =2.70.0, =2.71.1 - com.codbex.kronos:codbex-kronos-commons 2.70.0 and more Source cves: CVE-2026-108039 Source advisory: MEND:CVE-2026-108039...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), com.codbex.atlas:codbex-atlas-application (>=2.98.0, <=2.116.0) +413 more potentially affected by CVE-2026-108039 via org.apache.cxf:cxf-core (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-core MAVEN version =4.2.0, =2.98.0, =4.0.0-beta.1, =4.0.0-beta.1, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.4.0 - de.cezaryrk.olingo:odata-fit 5.1.0 - io.bootique.cxf:bootique-cxf-core 4.0-m6 and more Source cves: CVE-2026-108039 Source advisory: MEND:CVE-2026-108039...

ai.idylnlp:idylnlp-nlp-language-detection-tika (>=1.0.0, <=1.1.0), ai.mattmann.mnemosyne:cas-crawler (1.11.0) +3390 more potentially affected by CVE-2026-107937 via org.apache.cxf:cxf-core (>=3.0.0, <=3.6.12)

org.apache.cxf:cxf-core MAVEN version =3.0.0, =1.0.0, =1.11.0, =1.11.0, =1.0.0, =11.4-37, =3.6.1, =3.11.0, =3.19.0 and more Source cves: CVE-2026-107937 Source advisory: MEND:CVE-2026-107937...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), com.codbex.atlas:codbex-atlas-application (>=2.98.0, <=2.116.0) +413 more potentially affected by CVE-2026-107937 via org.apache.cxf:cxf-core (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-core MAVEN version =4.2.0, =2.98.0, =4.0.0-beta.1, =4.0.0-beta.1, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.4.0 - de.cezaryrk.olingo:odata-fit 5.1.0 - io.bootique.cxf:bootique-cxf-core 4.0-m6 and more Source cves: CVE-2026-107937 Source advisory: MEND:CVE-2026-107937...

ai.idylnlp:idylnlp-nlp-language-detection-tika (>=1.0.0, <=1.1.0), ai.mattmann.mnemosyne:cas-crawler (1.11.0) +3390 more potentially affected by CVE-2026-78384 via org.apache.cxf:cxf-core (>=3.0.0, <=3.6.12)

org.apache.cxf:cxf-core MAVEN version =3.0.0, =1.0.0, =1.11.0, =1.11.0, =1.0.0, =11.4-37, =3.6.1, =3.11.0, =3.19.0 and more Source cves: CVE-2026-78384 Source advisory: MEND:CVE-2026-78384...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), com.codbex.atlas:codbex-atlas-application (>=2.98.0, <=2.116.0) +413 more potentially affected by CVE-2026-78384 via org.apache.cxf:cxf-core (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-core MAVEN version =4.2.0, =2.98.0, =4.0.0-beta.1, =4.0.0-beta.1, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.4.0 - de.cezaryrk.olingo:odata-fit 5.1.0 - io.bootique.cxf:bootique-cxf-core 4.0-m6 and more Source cves: CVE-2026-78384 Source advisory: MEND:CVE-2026-78384...

cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening

A flaw was found in Apache CXF. The EndpointReferenceUtils and W3CMultiSchemaFactory classes within Apache CXF construct a SAXParserFactory without proper security configurations. This oversight enables out-of-band OOB external entity resolution, a type of XML External Entity XXE vulnerability. A...

cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening

A flaw was found in Apache CXF. The EndpointReferenceUtils and W3CMultiSchemaFactory classes within Apache CXF construct a SAXParserFactory without proper security configurations. This oversight enables out-of-band OOB external entity resolution, a type of XML External Entity XXE vulnerability. A...

Allocation of Resources Without Limits or Throttling

Overview org.apache.cxf:cxf-core is an an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the processing of...

be.atbash.test:integration-testing (2.2.0), be.atbash.test:integration-testing-database (2.2.0) +895 more potentially affected by CVE-2026-64958 via org.apache.cxf:cxf-core (>=4.0.0, <=4.1.7)

org.apache.cxf:cxf-core MAVEN version =4.0.0, =1.0.0, =12.1-7-21, =0.0.1, =1.1.0, =2.70.0, =2.71.1 - com.codbex.kronos:codbex-kronos-commons 2.70.0 and more Source cves: CVE-2026-64958 Source advisory: SNYK:JAVA-ORGAPACHECXF-19342002...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), com.codbex.atlas:codbex-atlas-application (>=2.98.0, <=2.116.0) +338 more potentially affected by CVE-2026-64958 via org.apache.cxf:cxf-core (>=4.2.0, <=4.2.2)

org.apache.cxf:cxf-core MAVEN version =4.2.0, =2.98.0, =4.0.0-beta.1, =4.0.0-beta.1, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.4 - io.camelbee:camelbee-quarkus-core 3.2.1 - io.camelbee:camelbee-quarkus-dependencies 3.2.1 - io.camelbee:camelbee-quarkus-security 3.2.1 and more Source cve...

ai.idylnlp:idylnlp-nlp-language-detection-tika (>=1.0.0, <=1.1.0), ai.mattmann.mnemosyne:cas-crawler (1.11.0) +3409 more potentially affected by CVE-2026-64958 via org.apache.cxf:cxf-core (>=3.0.0-milestone1, <=3.6.11)

org.apache.cxf:cxf-core MAVEN version =3.0.0-milestone1, =1.0.0, =1.11.0, =1.11.0, =1.0.0, =11.4-37, =3.6.1, =3.11.0, =3.19.0 and more Source cves: CVE-2026-64958 Source advisory: SNYK:JAVA-ORGAPACHECXF-19342002...

be.atbash.test:integration-testing (2.2.0), be.atbash.test:integration-testing-database (2.2.0) +895 more potentially affected by CVE-2026-64958 via org.apache.cxf:cxf-core (>=4.0.0, <=4.1.7)

org.apache.cxf:cxf-core MAVEN version =4.0.0, =1.0.0, =12.1-7-21, =0.0.1, =1.1.0, =2.70.0, =2.71.1 - com.codbex.kronos:codbex-kronos-commons 2.70.0 and more Source cves: CVE-2026-64958 Source advisory: MEND:CVE-2026-64958...

ai.idylnlp:idylnlp-nlp-language-detection-tika (>=1.0.0, <=1.1.0), ai.mattmann.mnemosyne:cas-crawler (1.11.0) +3409 more potentially affected by CVE-2026-64958 via org.apache.cxf:cxf-core (>=3.0.0-milestone1, <=3.6.11)

org.apache.cxf:cxf-core MAVEN version =3.0.0-milestone1, =1.0.0, =1.11.0, =1.11.0, =1.0.0, =11.4-37, =3.6.1, =3.11.0, =3.19.0 and more Source cves: CVE-2026-64958 Source advisory: MEND:CVE-2026-64958...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), com.codbex.atlas:codbex-atlas-application (>=2.98.0, <=2.116.0) +338 more potentially affected by CVE-2026-64958 via org.apache.cxf:cxf-core (>=4.2.0, <=4.2.2)

org.apache.cxf:cxf-core MAVEN version =4.2.0, =2.98.0, =4.0.0-beta.1, =4.0.0-beta.1, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.4 - io.camelbee:camelbee-quarkus-core 3.2.1 - io.camelbee:camelbee-quarkus-dependencies 3.2.1 - io.camelbee:camelbee-quarkus-security 3.2.1 and more Source cve...