Apache CXF OAuth2 HTTP Response Splitting via WWW-Authenticate Realm Injection
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50630 · GHSA-xf62-wr5p-5p95
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
51–55 of 55 matching · newest first
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50630 · GHSA-xf62-wr5p-5p95
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50629 · GHSA-f8p7-h97q-7vx7
Maven org.apache.cxf:cxf-core · Upgrade to 4.2.2, 4.1.7 or 3.6.12 by release line · >= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.7; < 3.6.12 · CVE-2026-49875 · GHSA-xw5h-cmh3-8j6j · amended
Maven org.apache.cxf:cxf-rt-rs-security-oauth2 · Upgrade to 4.2.2 or 4.1.7 by release line · >= 4.2.0, < 4.2.2; < 4.1.7 · CVE-2026-50631 · GHSA-83r6-96m8-r52p
Bitnami sqlite · Upgrade to 3.53.2 or later · < 3.53.2 · CVE-2026-11822
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.