| CVE-2026-95616 |
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation
|
Not rated
|
Sep 30, 2026 |
| CVE-2026-92899 |
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused
|
Not rated
|
Sep 30, 2026 |
| CVE-2026-92121 |
In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside…
|
Not rated
|
Sep 30, 2026 |
| CVE-2026-89238 |
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header,…
|
Not rated
|
Sep 30, 2026 |
| CVE-2026-88920 |
An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to…
|
Not rated
|
Sep 30, 2026 |
| CVE-2026-87830 |
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted…
|
Not rated
|
Sep 30, 2026 |
| CVE-2026-85532 |
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds
|
Not rated
|
Sep 30, 2026 |