Product by Apache Software Foundation
Apache WSS4J
12 known vulnerabilities in Apache WSS4J (Apache Software Foundation), 0 of them actively exploited (CISA KEV).
Key figures
12
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2020-13936 | Velocity Sandbox Bypass | 8.8 | |
| High | CVE-2015-0226 | Apache WSS4J: security vulnerability | 7.5 | |
| Critical | CVE-2026-88920 | Apache WSS4J: SAML Sender-Vouches Authentication Bypass | 9.8 | |
| High | CVE-2026-85532 | Apache WSS4J: Insufficient Validation of Derived-Key Parameters | 7.5 | |
| High | CVE-2026-92121 | Apache WSS4J: security vulnerability | 7.5 | |
| Critical | CVE-2026-89238 | Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection | 9.1 | |
| Medium | CVE-2011-2487 | Apache WSS4J: security vulnerability | 5.9 | |
| High | CVE-2026-95616 | Apache WSS4J: Integer Overflow | 7.5 | |
| Critical | CVE-2026-87830 | Apache WSS4J: security vulnerability | 9.1 | |
| Not rated | CVE-2014-3623 | Apache CXF: Spoofing | — | |
| Not rated | CVE-2015-0227 | Apache WSS4J: security vulnerability | — | |
| Medium | CVE-2026-92899 | Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce | 4.8 |