Known vulnerabilities in Apache CXF

Software: Apache CXF
Software CPE: cpe:2.3:a:apache_foundation:apache_cxf:*:*:*:*:*:*:*:*
Total vulnerabilities: 43
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Apache CXF Apache CXF is affected by 43 known vulnerabilities: 1 high, 29 medium, 13 low Critical High Medium Low

Vulnerabilities (43)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU145231 - Insufficient Verification of Data Authenticity
CVE-2026-50634
CWE-345 Low
No
No
4.1.7, 4.2.2 25.08.2026 SB2026070266
#VU145230 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-50633
CWE-74 Medium
No
No
4.1.7, 4.2.2 25.08.2026 SB2026070266
#VU145229 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-50632
CWE-74 Medium
No
No
4.1.7, 4.2.2 25.08.2026 SB2026070266
#VU145228 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-50631
CWE-367 Low
No
No
4.1.7, 4.2.2 25.08.2026 SB2026070266
#VU145227 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVE-2026-50630
CWE-113 Medium
No
No
4.1.7, 4.2.2 25.08.2026 SB2026070266
#VU145225 - Improper Authorization
CVE-2026-50628
CWE-285 Low
No
No
4.1.7, 4.2.2 25.08.2026 SB2026070266
#VU145224 - Improper Access Control
CVE-2026-50627
CWE-284 Low
No
No
4.1.7, 4.2.2 25.08.2026 SB2026070266
#VU145223 - Improper Authentication
CVE-2026-50623
CWE-287 Medium
No
No
4.1.7, 4.2.2 25.08.2026 SB2026070266
#VU144833 - Improper Access Control
CVE-2026-68481
CWE-284 Low
No
No
3.6.12, 4.1.8, 4.2.3 24.08.2026 SB20260824145
SB2026100258
#VU144832 - Always-Incorrect Control Flow Implementation
CVE-2026-68079
CWE-670 Medium
No
No
3.6.12, 4.1.8, 4.2.3 24.08.2026 SB20260824145
SB2026100258
#VU144831 - Improper Authentication
CVE-2026-65583
CWE-287 Medium
No
No
3.6.12, 4.1.8, 4.2.3 24.08.2026 SB20260824145
SB2026100258
#VU144830 - Improper input validation
CVE-2026-63687
CWE-20 Low
No
No
3.6.12, 4.1.8, 4.2.3 24.08.2026 SB20260824145
SB2026100258
#VU144829 - Improper Authorization
CVE-2026-61466
CWE-285 Low
No
No
3.6.12, 4.1.8, 4.2.3 24.08.2026 SB20260824145
SB2026100258
#VU144828 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-57818
CWE-367 Medium
No
No
3.6.12, 4.1.8, 4.2.3 24.08.2026 SB20260824145
SB2026100258
#VU144827 - Improper Authentication
CVE-2026-57817
CWE-287 Medium
No
No
3.6.12, 4.1.8, 4.2.3 24.08.2026 SB20260824145
SB2026100258
#VU144826 - Deserialization of Untrusted Data
CVE-2026-66909
CWE-502 High
No
No
3.6.12, 4.1.8, 4.2.3 24.08.2026 SB20260824145
SB2026100258
#VU144825 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2026-65432
CWE-611 Medium
No
No
3.6.12, 4.1.8, 4.2.3 24.08.2026 SB20260824145
SB2026091104
SB2026091617
and 1 more
#VU144824 - Improper input validation
CVE-2026-64958
CWE-20 Medium
No
No
3.6.12, 4.1.8, 4.2.3 24.08.2026 SB20260824145
SB2026090471
SB2026091109
and 2 more
#VU144823 - Allocation of Resources Without Limits or Throttling
CVE-2026-57819
CWE-770 Medium
No
No
3.6.12, 4.1.8, 4.2.3 24.08.2026 SB20260824145
SB2026090471
SB2026091109
and 3 more
#VU144822 - Allocation of Resources Without Limits or Throttling
CVE-2026-54225
CWE-770 Medium
No
No
3.6.12, 4.1.8, 4.2.3 24.08.2026 SB20260824145
SB2026090471
SB2026091109
and 2 more


Showing elements 1 - 20 out of 43