agentprime: apache-software-foundation-apache-cxfEvery new CVE for apache-software-foundation-apache-cxf.https://agentprime.io/CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limitshttps://agentprime.io/advisories/CVE-2026-108039/https://agentprime.io/advisories/CVE-2026-108039/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Oct 2026 10:22:35 GMTCVECVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.https://agentprime.io/advisories/CVE-2026-107938/https://agentprime.io/advisories/CVE-2026-107938/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Oct 2026 10:20:11 GMTCVEcriticalCVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.https://agentprime.io/advisories/CVE-2026-107937/https://agentprime.io/advisories/CVE-2026-107937/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Oct 2026 10:19:53 GMTCVECVE-2026-100227: Apache CXF: XML Signature wrapping in JAX-RS XML Securityhttps://agentprime.io/advisories/CVE-2026-100227/https://agentprime.io/advisories/CVE-2026-100227/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Oct 2026 10:19:40 GMTCVECVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requestshttps://agentprime.io/advisories/CVE-2026-97791/https://agentprime.io/advisories/CVE-2026-97791/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Oct 2026 10:19:26 GMTCVECVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokenshttps://agentprime.io/advisories/CVE-2026-97468/https://agentprime.io/advisories/CVE-2026-97468/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Oct 2026 10:18:56 GMTCVEcriticalCVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Servicehttps://agentprime.io/advisories/CVE-2026-86463/https://agentprime.io/advisories/CVE-2026-86463/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Oct 2026 10:18:42 GMTCVECVE-2026-79650: Apache CXF: OIDC RP Open Redirecthttps://agentprime.io/advisories/CVE-2026-79650/https://agentprime.io/advisories/CVE-2026-79650/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Oct 2026 10:18:21 GMTCVECVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)https://agentprime.io/advisories/CVE-2026-78384/https://agentprime.io/advisories/CVE-2026-78384/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Oct 2026 10:18:00 GMTCVECVE-2026-73179: Apache CXF: JPA authorization-code consume is non-atomichttps://agentprime.io/advisories/CVE-2026-73179/https://agentprime.io/advisories/CVE-2026-73179/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Oct 2026 10:17:41 GMTCVECVE-2026-71575: Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilterhttps://agentprime.io/advisories/CVE-2026-71575/https://agentprime.io/advisories/CVE-2026-71575/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Oct 2026 10:17:18 GMTCVEcriticalCVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProviderhttps://agentprime.io/advisories/CVE-2026-57818/https://agentprime.io/advisories/CVE-2026-57818/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 11:24:53 GMTCVECVE-2026-61466: Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalationhttps://agentprime.io/advisories/CVE-2026-61466/https://agentprime.io/advisories/CVE-2026-61466/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 11:24:27 GMTCVEcriticalCVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parametershttps://agentprime.io/advisories/CVE-2026-63687/https://agentprime.io/advisories/CVE-2026-63687/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 11:23:45 GMTCVEcriticalCVE-2026-65583: Apache CXF: Self-issued ID token claims validation skippedhttps://agentprime.io/advisories/CVE-2026-65583/https://agentprime.io/advisories/CVE-2026-65583/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 11:23:17 GMTCVEcriticalCVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replayhttps://agentprime.io/advisories/CVE-2026-68079/https://agentprime.io/advisories/CVE-2026-68079/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 11:22:57 GMTCVEcriticalCVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProviderhttps://agentprime.io/advisories/CVE-2026-68481/https://agentprime.io/advisories/CVE-2026-68481/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 11:22:37 GMTCVECVE-2026-65432: Apache CXF: XXE via WSDL/XSD import parsinghttps://agentprime.io/advisories/CVE-2026-65432/https://agentprime.io/advisories/CVE-2026-65432/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 10:26:12 GMTCVECVE-2026-57817: Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flowhttps://agentprime.io/advisories/CVE-2026-57817/https://agentprime.io/advisories/CVE-2026-57817/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 10:24:05 GMTCVECVE-2026-66909: Apache CXF: Unsafe deserialization of inbound JMS ObjectMessagehttps://agentprime.io/advisories/CVE-2026-66909/https://agentprime.io/advisories/CVE-2026-66909/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 10:23:23 GMTCVEcriticalCVE-2026-64958: Apache CXF: Denial of service via message header attachmentshttps://agentprime.io/advisories/CVE-2026-64958/https://agentprime.io/advisories/CVE-2026-64958/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 10:13:04 GMTCVECVE-2026-57819: Apache CXF: No default restriction on the amount of form parameters per messagehttps://agentprime.io/advisories/CVE-2026-57819/https://agentprime.io/advisories/CVE-2026-57819/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 10:12:26 GMTCVECVE-2026-54225: Apache CXF: Denial of Service attack via large attachmentshttps://agentprime.io/advisories/CVE-2026-54225/https://agentprime.io/advisories/CVE-2026-54225/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 10:11:41 GMTCVE