spring-ws

• CVE-2026-40994 - Spring WS BSP validation disabled by default 2026-06-15
• CVE-2026-40998 - Spring WS XPath XXE via StreamSource and SAXSource 2026-06-15