https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T21:06:44.785676+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349188 EUVD-2026-349188 2026-10-04T21:06:44.834270+00:00 EUVD-2026-349188 https://cve.radiocsirt.org/vuln/fkie_cve-2026-68481 fkie_cve-2026-68481 2026-10-04T21:06:44.834305+00:00

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and 'introspection of a revoked token MUST return {"active":false}'. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

 https://cve.radiocsirt.org/vuln/ghsa-5c8v-93q6-cjxj GHSA-5c8v-93q6-cjxj 2026-10-04T21:06:44.834340+00:00

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and 'introspection of a revoked token MUST return {"active":false}'. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2682 WID-SEC-W-2026-2682 — Apache CXF: Mehrere Schwachstellen 2026-10-04T21:06:44.834360+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache CXF ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.