CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 09:30 UTC)

What this means for you

This week: 5,436 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,436; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product apache_software_foundation:apache_cxf. Show all products

23 CVEs, showing 1 to 23

CVE	Severity	Title	Published
CVE-2026-54225	High 7.5	Apache CXF: Denial of Service attack via large attachments Assigned by apache	Aug 6, 2026
CVE-2026-57819	High 7.5	Apache CXF: No default restriction on the amount of form parameters per message Assigned by apache	Aug 6, 2026
CVE-2026-64958	High 7.5	Apache CXF: Denial of service via message header attachments Assigned by apache	Aug 6, 2026
CVE-2026-66909	Critical 9.8	Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage Assigned by apache	Aug 6, 2026
CVE-2026-57817	High 8.1	Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow Assigned by apache	Aug 6, 2026
CVE-2026-65432	High 7.5	Apache CXF: XXE via WSDL/XSD import parsing Assigned by apache	Aug 6, 2026
CVE-2026-68481	High 7.5	Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider Assigned by apache	Aug 6, 2026
CVE-2026-68079	Critical 9.8	Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay Assigned by apache	Aug 6, 2026
CVE-2026-65583	Critical 9.1	Apache CXF: Self-issued ID token claims validation skipped Assigned by apache	Aug 6, 2026
CVE-2026-63687	Critical 9.1	Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters Assigned by apache	Aug 6, 2026
CVE-2026-61466	Critical 9.1	Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation Assigned by apache	Aug 6, 2026
CVE-2026-57818	High 8.1	Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider Assigned by apache	Aug 6, 2026
CVE-2026-71575	Critical 9.1	Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter Assigned by apache	Oct 9, 2026
CVE-2026-73179	High 8.1	Apache CXF: JPA authorization-code consume is non-atomic Assigned by apache	Oct 9, 2026
CVE-2026-78384	High 7.5	Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb) Assigned by apache	Oct 9, 2026
CVE-2026-79650	Medium 6.1	Apache CXF: OIDC RP Open Redirect Assigned by apache	Oct 9, 2026
CVE-2026-86463	High 7.5	Apache CXF: FIQL Query Parser Denial of Service Assigned by apache	Oct 9, 2026
CVE-2026-97468	Critical 9.1	Apache CXF: Authentication bypass via weak cache keys for validated STS tokens Assigned by apache	Oct 9, 2026
CVE-2026-97791	High 7.5	Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests Assigned by apache	Oct 9, 2026
CVE-2026-100227	High 7.5	Apache CXF: XML Signature wrapping in JAX-RS XML Security Assigned by apache	Oct 9, 2026
CVE-2026-107937	High 7.5	Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion. Assigned by apache	Oct 9, 2026
CVE-2026-107938	Critical 9.1	Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. Assigned by apache	Oct 9, 2026
CVE-2026-108039	High 7.5	Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits Assigned by apache	Oct 9, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.