Apache Software Foundation Apache WSS4J

• CVE-2026-95616 High 7.5 Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions 0.4%
• CVE-2026-92899 Medium 4.8 Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce 0.5%
• CVE-2026-92121 High 7.5 Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference 0.5%
• CVE-2026-89238 Critical 9.1 Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection 0.3%
• CVE-2026-88920 Critical 9.8 Apache WSS4J: SAML Sender-Vouches Authentication Bypass 0.6%
• CVE-2026-87830 Critical 9.1 Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks. 0.2%
• CVE-2026-85532 High 7.5 Apache WSS4J: Insufficient Validation of Derived-Key Parameters 0.5%