https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:30:09.994325+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-104586 EUVD-2026-104586 2026-10-03T07:30:09.998997+00:00 EUVD-2026-104586 https://cve.radiocsirt.org/vuln/fkie_cve-2013-0239 fkie_cve-2013-0239 2026-10-03T07:30:09.999026+00:00

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.

 https://cve.radiocsirt.org/vuln/ghsa-p5c5-6564-vvr8 GHSA-p5c5-6564-vvr8 — Improper Authentication in Apache CXF 2026-10-03T07:30:09.999056+00:00

Affected: Maven: org.apache.cxf:cxf-rt-frontend-jaxrs

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.

 https://cve.radiocsirt.org/vuln/gsd-2013-0239 gsd-2013-0239 2026-10-03T07:30:09.999081+00:00 gsd-2013-0239 https://cve.radiocsirt.org/vuln/rhsa-2013:0644 RHSA-2013:0644 — Red Hat Security Advisory: apache-cxf security update 2026-10-03T07:30:09.999094+00:00

apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate