CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...

CVE-2026-64958

The Apache CXF library is susceptible to a denial of service (DoS) attack due to an incomplete fix for CVE-2026-50645 . An attacker can trigger this by sending a message containing an excessive number of attachment headers , leading to uncontrolled resource consumption. This vulnerability affects...

CVE-2026-64958 Apache CXF: Denial of service via message header attachments

An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue...

CVE-2026-64958 Apache CXF: Denial of service via message header attachments

An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue...

CVE-2026-57819 Apache CXF: No default restriction on the amount of form parameters per message

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are...

CVE-2026-57819

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are...

CVE-2026-57819

The Apache CXF library allows for configuring the number of form parameters in a JAX-RS message via the "maxFormParameterCount" option. However, because no default limit is set, the software is susceptible to denial of service (DoS) attacks when processing requests containing a very large number ...

CVE-2026-57819 Apache CXF: No default restriction on the amount of form parameters per message

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are...

EUVD-2026-53851

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update t...

[SECURITY] [DSA 6413-1] libde265 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6413-1 [email protected] https://www.debian.org/security/ Aron Xu August 06, 2026 https://www.debian.org/security/faq -...

Security Bulletin: IBM Engineering Requirements Management DOORS Next is impacted by vulnerability in Reviews delete request

Summary Vulnerability has been identified in Review delete request, which is used in IBM Engineering Requirements Management DOORS Next. Vulnerability Details CVEID:CVE-2024-27253 DESCRIPTION: IBM Engineering Systems Design Rhapsody - Model Manager could allow an authenticated user to bypass...

Security Bulletin: IBM Engineering Lifecycle Management - Doors Next is impacted by vulnerability

Summary A vulnerability has been identified in Json-smart library, which is used in IBM Engineering Lifecycle Management - Doors Next. Vulnerability Details CVEID:CVE-2023-1370 DESCRIPTION:Json-smart is a performance focused, JSON processor lib. When reaching a ‘‘ or ‘‘ character in the JSON inpu...

CVE-2026-41862 - Arbitrary Root File Write via Path Traversal in BOSH agent | Cloud Foundry

Low CVSSv4: Low 2.3 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSSv3: Medium 4.2 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Vendor CloudFoundry Foundation Versions Affected Severity is Medium unless otherwise noted. BOSH – All bosh agent versions v2.847.0 jammy = v1.1202, ...

SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2026:3510-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3510-1 advisory. - CVE-2026-7260: Stack overflow in phar with circular symlinks bsc1273077. - CVE-2026-9672: Upgrade libgd bsc1273078. -...

Debian dla-4721 : libasync-http-client-java - security update

The remote Debian 11 / 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4721 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4721-1 [email protected]...

EulerOS 2.0 SP13 : httpd (EulerOS-SA-2026-3020)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are...

EulerOS 2.0 SP13 : unbound (EulerOS-SA-2026-3004)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to...

EulerOS 2.0 SP15 : libXpm (EulerOS-SA-2026-2892)

According to the versions of the libXpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in X.org libXpm up to 3.5.4. It has been classified as problematic.CWE is classifying the issue as CWE-125. The product...

macOS 14.x < 14.8.9 (148172)

The remote host is running a version of macOS / Mac OS X that is 14.x prior to 14.8.9. It is, therefore, affected by a vulnerability: - An authentication issue was addressed with improved state management. CVE-2026-65400 Note that Nessus has not tested for this issue but has instead relied only o...

EulerOS 2.0 SP13 : libXpm (EulerOS-SA-2026-2974)

According to the versions of the libXpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in X.org libXpm up to 3.5.4. It has been classified as problematic.CWE is classifying the issue as CWE-125. The product...