Security advisories

high2026-06-12

CVE-2026-50645-Apache cxf-core: No restriction on attachment headers per message

apache/cxf · GHSA-ghvc-7hp8-2g2v

critical2026-06-12

CVE-2026-50632-Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory

apache/cxf · GHSA-93g8-qqv3-mrx8

medium2026-06-12

CVE-2026-50634-Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry

apache/cxf · GHSA-33j8-j763-4fv5

critical2026-06-12

CVE-2026-49875-Apache CXF has Improper Restriction of XML External Entity Reference

apache/cxf · GHSA-xw5h-cmh3-8j6j

medium2026-06-12

CVE-2026-50630-Apache CXF OAuth2 HTTP Response Splitting via WWW-Authenticate Realm Injection

apache/cxf · GHSA-xf62-wr5p-5p95

critical2026-06-12

CVE-2026-50628-Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control

apache/cxf · GHSA-g5v7-jchf-7jrr

high2026-06-12

CVE-2026-50629-Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier

apache/cxf · GHSA-f8p7-h97q-7vx7

critical2026-06-12

CVE-2026-50627-Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

apache/cxf · GHSA-9mrv-8pvf-hf4m

high2026-06-12

CVE-2026-50631-Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing

apache/cxf · GHSA-83r6-96m8-r52p

medium2026-06-12

CVE-2026-50623-Apache CXF has Authentication Bypass in OAuth2 TokenIntrospectionService

apache/cxf · GHSA-542g-m3fx-q86f

medium2026-06-11

CVE-2026-53782-@steipete/summarize vulnerable to SSRF via podcast:transcript URL fetch

steipete/summarize · GHSA-3vx2-vqx8-jxfg

medium2026-06-11

CVE-2026-53781-@steipete/summarize is Vulnerable to Disk Exhaustion via Crafted Media Responses

steipete/summarize · GHSA-q9xm-f36c-xm3q

high2026-06-11

CVE-2026-48109- MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

messagepack-csharp/messagepack-csharp · GHSA-hv8m-jj95-wg3x

high2026-06-11

CVE-2025-27511-GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

geoserver/geoserver · GHSA-g628-r368-6vh7

high2026-06-11

CVE-2026-48110-Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds

eugeny/russh · GHSA-4r3c-5hpg-58qr

high2026-06-11

CVE-2026-11401-AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance

aws/aws-advanced-go-wrapper · GHSA-r236-5pc3-3qcp

medium2026-06-11

CVE-2026-48108-Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input

eugeny/russh · GHSA-76r6-x97p-67vr

medium2026-06-11

CVE-2026-48107-Russh: Unchecked keyboard-interactive prompt count in client auth path

eugeny/russh · GHSA-g9g7-5cgw-6v28

high2026-06-11

CVE-2026-48099-WsgiDAV encoded dot segments can escape filesystem share roots

mar10/wsgidav · GHSA-wxq4-cc2q-338q

medium2026-06-11

CVE-2026-48096-OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning

openfga/openfga · GHSA-8396-jffm-qx4w