Apache Apache Axis2/java
8 CVEs affecting Apache Apache Axis2/java. Latest disclosed: 2026-11-09. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66713 | Critical | 9.8 | 2026-07-28 | Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache… |
CVE-2026-120367 | High | 7.5 | 2026-11-09 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 varian… |
CVE-2026-123779 | | 2026-11-09 | Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?… | |
CVE-2026-123770 | | 2026-11-09 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message… | |
CVE-2026-123766 | | 2026-11-09 | Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI pag… | |
CVE-2026-123753 | | 2026-11-09 | Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa… | |
CVE-2026-120832 | | 2026-11-09 | Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.c… | |
CVE-2026-120761 | | 2026-11-09 | Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceCl… |