Wss4j vulnerabilitiesRanked by how likely they are to be used.
Wss4j is made by Apache. We track 5 published vulnerabilities in it, across 61 versions. None of them is on the list of flaws known to be exploited today. If you run Wss4j, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Wss4j vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Wss4j's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Wss4j flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 23%CVE-2020-13936High
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container.
- 9.2%CVE-2014-3623Medium
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security...
- 7.5%CVE-2015-0227Medium
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
- 5.5%CVE-2015-0226High
Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the...
- 1.8%CVE-2011-2487Medium
The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.
- 0.5%CVE-2026-92121High
In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set.
- 0.4%CVE-2026-95616High
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation.
- 0.3%CVE-2026-89238Critical
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass.
- 0.2%CVE-2026-87830Critical
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path.
Running Wss4j? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
- Matched to
- Wss4j on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 5 published vulnerabilities listed under the name Wss4j, across 61 versions.
None of Wss4j's vulnerabilities is on the list of flaws known to be exploited today.
Create a Precursor Intelligence account and track Wss4j. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.