Login Request a demo
AC
Product
Apache CXF
by Apache Software Foundation · last CVE Oct 9, 2026
43
CVEs
0
On KEV
9.8
Max CVSS
11
New 30D
Vulnerabilities43In the news0Timeline
Severity mix
Critical 14High 22Medium 7Low 0
Severity
All severities43Critical14High22Medium7Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache CXF to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-50634
6.5
0%
Jun 12
Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry
Affected: 4.2.0 before 4.2.2; 4.0.0 before 4.1.7; before 3.6.12
CVE-2026-50630
6.5
0%
Jun 12
Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection
Affected: 4.2.0 before 4.2.2; 4.0.0 before 4.1.7; before 3.6.12
CVE-2026-79650
6.1
0%
Oct 9
Apache CXF: OIDC RP Open Redirect
Affected: 4.2.0 before 4.2.4; 4.0.0 before 4.1.9; before 3.6.13
CVE-2025-48795
5.6
1%
Jul 15
Apache CXF: Denial of Service and sensitive data exposure in logs
Affected: 3.5.10 before 3.5.11; 3.6.5 before 3.6.6; 4.0.6 before 4.0.7; 4.1.0 before 4.1.1
CVE-2026-50629
5.3
0%
Jun 12
Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier
Affected: 4.2.0 before 4.2.2; 4.0.0 before 4.1.7; before 3.6.12
CVE-2026-44618
5.3
0%
May 22
Apache CXF: XXE vulnerability in WS-Transfer functionality
Affected: 4.2.0 before 4.2.1; 4.0.0 before 4.1.6; before 3.6.11
CVE-2026-50623
4.8
0%
Jun 12
Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
Affected: 4.2.0 before 4.2.2; 4.0.0 before 4.1.7; before 3.6.12
Showing 7