https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T21:30:17.001171+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-111086 EUVD-2026-111086 2026-10-02T21:30:17.019659+00:00 EUVD-2026-111086 https://cve.radiocsirt.org/vuln/fkie_cve-2012-2378 fkie_cve-2012-2378 2026-10-02T21:30:17.019714+00:00

Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.

 https://cve.radiocsirt.org/vuln/ghsa-vjpc-vf4f-82qg GHSA-vjpc-vf4f-82qg — Improper Authentication in Apache CXF 2026-10-02T21:30:17.019763+00:00

Affected: Maven: org.apache.cxf:cxf

Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.

 https://cve.radiocsirt.org/vuln/gsd-2012-2378 gsd-2012-2378 2026-10-02T21:30:17.019808+00:00 gsd-2012-2378 https://cve.radiocsirt.org/vuln/rhsa-2012:1591 RHSA-2012:1591 — Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 update 2026-10-02T21:30:17.019822+00:00

httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled apache-cxf: Certain child policies of WS-SecurityPolicy 1.1 SupportingToken policy not applied on the client side apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token Mojarra: deployed web applications can read FacesContext from other applications under certain conditions httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled JBoss: Datasource connection manager returns valid connection for wrong credentials when using security-domains apache-cxf: SOAPAction spoofing on document literal web services JBoss Enterprise Application Platform: org.jboss.as.ejb3: JBoss Enterprise Application Platform: Access restriction bypass via improper EJB method authorization JBoss Enterprise Application Platform: JBoss EAP: JBEAP: JBoss Enterprise Application Platform: Unauthorized EJB access via authorization module bypass