CVE-2026-64958

An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

• CWE-400

• https://lists.apache.org/thread/trsnkxc2f21585zlt819blvchgl6oykbMailing List, Vendor Advisory

Published

Aug 6, 2026

Last Modified

Aug 6, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-64941URL Redirection to Untrusted Site ('Open Redirect') vulnerab…2.1
• CVE-2026-6495The Ajax Load More WordPress plugin before 7.8.4 does not s…7.1
• CVE-2026-64951A rogue Velociraptor client can upload a malformed sparse fi…3.5
• CVE-2026-64952The hunt_delete() VQL function allows deleting hunts.  Velo…6.5
• CVE-2026-64954Velociraptor allows scheduling new collections via VQL queri…8.2
• CVE-2026-64955When Microsoft Excel imports a CSV file, it executes cells b…6.1
• CVE-2026-6496A vulnerability was found in prasathmani TinyFileManager up …5.4
• CVE-2026-6497A vulnerability was determined in prasathmani TinyFileManage…6.3
• CVE-2026-6498The Five Star Restaurant Reservations plugin for WordPress i…5.3
• CVE-2026-6499Incorrect Permission Assignment for Critical Resource vulner…2.4
• CVE-2026-64993Dell RVTools versions prior to 4.8.1, contains an improper c…9.1
• CVE-2026-6500Plaintext storage of a password vulnerability in ILM Informa…4.8