https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-23T21:33:31.386941+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-385064 EUVD-2026-385064 2026-10-23T21:33:31.440329+00:00 EUVD-2026-385064 https://cve.radiocsirt.org/vuln/fkie_cve-2026-73179 fkie_cve-2026-73179 2026-10-23T21:33:31.440396+00:00

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic find-then-delete operation against a shared relational database under READ_COMMITTED isolation. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fixes this issue.

 https://cve.radiocsirt.org/vuln/ghsa-4856-vwpx-pmq8 GHSA-4856-vwpx-pmq8 2026-10-23T21:33:31.440444+00:00

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic find-then-delete operation against a shared relational database under READ_COMMITTED isolation. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fixes this issue.