CoreWCF vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 202613

Newest CVEs

• CVE-2026-54782

  CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation

  CoreWCF · CoreWCF

  Critical10.0
• CVE-2026-54781

  CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced

  CoreWCF · CoreWCF

  High7.4
• CVE-2026-54784

  CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

  CoreWCF · CoreWCF

  High7.4
• CVE-2026-54774

  CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate

  CoreWCF · CoreWCF

  High7.4
• CVE-2026-54783

  CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages

  CoreWCF · CoreWCF

  High7.4
• CVE-2026-54780

  CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass

  CoreWCF · CoreWCF

  Low3.7
• CVE-2026-54775

  CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

  CoreWCF · CoreWCF

  Medium6.5
• CVE-2026-54778

  CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution

  CoreWCF · CoreWCF

  Medium6.2
• CVE-2026-54773

  CoreWCF: WS-Security signature substitution via document-wide Signature lookup

  CoreWCF · CoreWCF

  Medium5.9
• CVE-2026-54779

  CoreWCF: SAML token replay protection is inoperative

  CoreWCF · CoreWCF

  Medium5.9