| CVE-2026-41000 |
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for…
|
3.7
Faible
|
11 juin 2026 |
| CVE-2026-40999 |
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound…
|
8.6
Élevée
|
11 juin 2026 |
| CVE-2026-40998 |
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed…
|
8.2
Élevée
|
11 juin 2026 |
| CVE-2026-40997 |
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or…
|
5.3
Moyenne
|
11 juin 2026 |
| CVE-2026-40996 |
Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default…
|
4.8
Moyenne
|
11 juin 2026 |
| CVE-2026-40995 |
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped…
|
5.4
Moyenne
|
11 juin 2026 |
| CVE-2026-40994 |
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation…
|
8.2
Élevée
|
11 juin 2026 |
| CVE-2019-3773 |
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to…
|
Non notée
|
18 janv. 2019 |