| CVE-2026-41000 |
Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for…
|
3.7
Low
|
Jun 11, 2026 |
| CVE-2026-40999 |
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound…
|
8.6
High
|
Jun 11, 2026 |
| CVE-2026-40998 |
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed…
|
8.2
High
|
Jun 11, 2026 |
| CVE-2026-40997 |
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or…
|
5.3
Medium
|
Jun 11, 2026 |
| CVE-2026-40996 |
Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default…
|
4.8
Medium
|
Jun 11, 2026 |
| CVE-2026-40995 |
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped…
|
5.4
Medium
|
Jun 11, 2026 |
| CVE-2026-40994 |
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation…
|
8.2
High
|
Jun 11, 2026 |
| CVE-2019-3773 |
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to…
|
Not rated
|
Jan 18, 2019 |