NVD Vulnerabilities

Severity Distribution

Publication Trend

Vulnerability Database

CVE ID Description Published Base Score Attack Vector Severity Actions
CVE-2026-68481 In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:tru... 2026-08-06 7.5 NETWORK HIGH NVD
CVE-2026-68079 In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the imp... 2026-08-06 9.8 NETWORK CRITICAL NVD
CVE-2026-65583 Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/t... 2026-08-06 9.1 NETWORK CRITICAL NVD
CVE-2026-63687 Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitiv... 2026-08-06 9.1 NETWORK CRITICAL NVD
CVE-2026-61466 In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client regi... 2026-08-06 9.1 NETWORK CRITICAL NVD
CVE-2026-57818 A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting ... 2026-08-06 8.1 NETWORK HIGH NVD