14 Total advisories
14 Vulnerabilities
0 Malware
Dependency scanning
Check whether org.apache.cxf:cxf-core is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Vulnerabilities
CRITICAL 9.8
CVE-2026-49875
Apache CXF has Improper Restriction of XML External Entity Reference
MEDIUM 5.6
CVE-2025-48795
Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged
HIGH 7.5
CVE-2026-50645
Apache cxf-core: No restriction on attachment headers per message
HIGH 7.5
CVE-2025-23184
Apache CXF: Denial of Service vulnerability with temporary files
MEDIUM 6.1
CVE-2016-6812
Improper Neutralization of Input During Web Page Generation in Apache CXF
HIGH 7.5
CVE-2017-5656
Session Fixation in Apache CXF
HIGH 7.5
CVE-2016-8739
Improper Restriction of XML External Entity Reference in Apache CXF JAX-RS
MEDIUM 5.3
CVE-2017-5653
Improper Certificate Validation in Apache CXF
MEDIUM 5.5
CVE-2017-12624
Improper Input Validation in Apache CXF
HIGH 7.5
CVE-2022-46363
Apache CXF vulnerable to Exposure of Sensitive Information
UNKNOWN
CVE-2014-0110
Uncontrolled Resource Consumption in Apache CXF
UNKNOWN
CVE-2014-0109
Uncontrolled Resource Consumption in Apache CXF
UNKNOWN
CVE-2014-0035
Cleartext Transmission of Sensitive Information in Apache CXF
CRITICAL 9.8
CVE-2022-46364
Apache CXF Server-Side Request Forgery vulnerability
Browse more Maven advisories
Learn What is SAST?
Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →
Ready to move
Start Securing
Free, no credit card | First findings in minutes