org.apache.cxf:cxf-core vulnerabilities (Root)

2 vulnerabilities.

• org.apache.cxf:cxf-core Root Apache CXF: No restriction on attachment headers per message CVE-2026-50645 Fix available 7.5 HighJune 12, 2026
• org.apache.cxf:cxf-core Root Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils CVE-2026-49875 Fix available 9.8 CriticalJune 12, 2026