https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T01:32:47.162371+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-96611 EUVD-2026-96611 2026-10-03T01:32:47.173524+00:00 EUVD-2026-96611 https://cve.radiocsirt.org/vuln/fkie_cve-2014-0035 fkie_cve-2014-0035 2026-10-03T01:32:47.173563+00:00

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

 https://cve.radiocsirt.org/vuln/ghsa-v45r-rj5x-hpg2 GHSA-v45r-rj5x-hpg2 — Cleartext Transmission of Sensitive Information in Apache CXF 2026-10-03T01:32:47.173607+00:00

Affected: Maven: org.apache.cxf:cxf-core

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

 https://cve.radiocsirt.org/vuln/gsd-2014-0035 gsd-2014-0035 2026-10-03T01:32:47.173634+00:00 gsd-2014-0035 https://cve.radiocsirt.org/vuln/rhsa-2014:0797 RHSA-2014:0797 — Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 update 2026-10-03T01:32:47.173646+00:00

CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy CXF: HTML content posted to SOAP endpoint could cause OOM errors CXF: Large invalid content could cause temporary space to fill JAX-RS: Information disclosure via XML eXternal Entity (XXE)