Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities due to Apache CXF (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary There are mulitple vulnerabilities in the Apache CXF library that affect IBM WebSphere Application Server and affect WebSphere Application Server Liberty when the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, or xmlWS-4.0 features are enabled. Vulnerability Details CVEID:CVE-2026-57819...

CVE-2026-44618

A flaw was found in Apache CXF. An insecure XML parser configuration within Apache CXF's WS-Transfer module may allow a remote attacker to perform XML External Entity XXE attacks. This could lead to information disclosure, denial of service, or server-side request forgery. Mitigation If using...

DoS (Denial of Service) ws Dependency in Bitbucket Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.5, 10.0.0, 10.1.1, 10.2.0, 10.3.0, and 10.4.1 of Bitbucket Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

Security Bulletin:Vulnerability in ws affects IBM Netezza Appliance

Summary The ws package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-48779 Vulnerability Details CVEID:CVE-2026-48779 DESCRIPTION: ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to but not including 5.2.5...

CLSA-2026-1785380875 TuxCare security update for ws (1 CVE)

TuxCare rebuilt ws to address 1 CVE. Fixed in 6.2.1-tuxcare.2...

CLSA-2026-1784769503 TuxCare security update for ws (1 CVE)

TuxCare rebuilt ws to address 1 CVE. Fixed in 8.20.0-tuxcare.2...

CLSA-2026-1784596324 TuxCare security update for ws (1 CVE)

TuxCare rebuilt ws to address 1 CVE. Fixed in 8.18.0-tuxcare.1...

CLSA-2026-1784596272 TuxCare security update for ws (2 CVEs)

TuxCare rebuilt ws to address 2 CVEs. Fixed in 0.8.1-tuxcare.1...

sharepoint-2026-poc

SharePoint /trust WS-Federation Deserialization — PoC & Det...

-fides-amor-et-lux (1.0.0), -price-checker (>=1.0.0, <=1.0.5) +50534 more potentially affected by CVE-2026-62389 via ws (>=8.0.0, <=8.21.0)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =1.1.0, =0.1.0-rc.7, =0.1.0, =1.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-62389 Source advisory: SNYK:JS-WS-17988732...

MAL-2026-10402 Malicious code in @gleamkit/ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fc9213fe9e786988b3fd882b571f03aeaa1487b8006badb837b4e804da66eee The package publishes under scope @gleamkit/ws while copying the ws package's description, homepage, repository, author, and README verbatim, and...

CVE-2026-54780

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, the CoreWCF WS-Security 1.0 receive pipeline validates ds:SignedInfo SignatureMethod against the configured SecurityAlgorithmSuite but does not validate each ds:Reference...

CVE-2026-54773

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security signature verification performs a document-wide ds:Signature lookup, allowing an unauthenticated remote attacker to place a SOAP header before wsse:Security an...

CVE-2026-54783 CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security endorsing and supporting signature verification does not ensure the selected ds:Signature covers the expected Security header target, allowing an attacker with...

CVE-2026-54780 CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, the CoreWCF WS-Security 1.0 receive pipeline validates ds:SignedInfo SignatureMethod against the configured SecurityAlgorithmSuite but does not validate each ds:Reference...

CVE-2026-54780 CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, the CoreWCF WS-Security 1.0 receive pipeline validates ds:SignedInfo SignatureMethod against the configured SecurityAlgorithmSuite but does not validate each ds:Reference...

CVE-2026-54773

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security signature verification performs a document-wide ds:Signature lookup, allowing an unauthenticated remote attacker to place a SOAP header before wsse:Security an...

CVE-2026-54773 CoreWCF: WS-Security signature substitution via document-wide Signature lookup

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security signature verification performs a document-wide ds:Signature lookup, allowing an unauthenticated remote attacker to place a SOAP header before wsse:Security an...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in ws

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in ws. CCVE-2026-45736 The vulnerability have been addressed. Vulnerability Details CVEID:CVE-2026-45736 DESCRIPTION: ws is an open source WebSocket client and server for Node.js. Pri...

CVE-2026-11562

The WS Form LITE WordPress plugin before 1.11.8 does not have a capability check on one of its settings-update actions, allowing authenticated users with subscriber-level access and above to modify the WS Form LITE WordPress plugin before 1.11.8's settings...