cloud.subzero:subzero (>=2.0.8, <=3.0.1), cn.hiauth:hiauth-client-session-spring-boot-starter (3.0.0) +440 more potentially affected by CVE-2025-66614 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.14)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =2.0.8, =7.0.0-m1, =3.1.0, =3.0.0, =3.0.0, =4.0.0 - co.ipregistry:ipregistry-spring-boot-mvc 1.0.0 - co.ipregistry:ipregistry-spring-boot-webflux 1.0.0 - com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-model-chat-memory-mem0...

Improper Certificate Validation

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Improper Certificate Validation in the SNI extension, when client certificate authentication relies exclusively on the Connector and is not enforced in the web...

ai.platon.pulsar:pulsar-e2e-tests (>=4.5.0, <=4.6.0), ai.platon.pulsar:pulsar-it-tests (>=4.5.0, <=4.6.0) +812 more potentially affected by CVE-2026-24734 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.15)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =0.1.1, =0.2.0, =0.2.0, =0.3.0 - br.com.sawcunhaos:scos-foundation-audit 1.0.0 - br.com.sawcunhaos:scos-foundation-exception 1.0.0 - br.com.sawcunhaos:scos-foundation-jdempotent 1.0.0 -...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +8490 more potentially affected by CVE-2026-24734 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m7, <=10.1.50)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m7, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-24734 Source advisory:...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +8324 more potentially affected by CVE-2025-66614 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.1.49)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-66614 Source advisory:...

ai.chat2db.excel:easyexcel-plus-test (0.0.1), au.csiro.pathling:fhir-server (>=6.4.0, <=6.4.2) +2329 more potentially affected by CVE-2026-24734 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.83, <=9.0.113)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.83, =6.4.0, =2.3.0, =2.3.0, =2.4.1 - au.org.consumerdatastandards:mock-data-holder-java 2.6.0 - cc.chensoul.nacos:core-test 2.5.2 - cc.chensoul.nacos:nacos-address 2.5.2 - cc.chensoul.nacos:nacos-auth 2.5.2 - cc.chensoul.nacos:nacos-cmd...

Incorrect Authorization

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Incorrect Authorization when using an OCSP responder. OCSP response verification and freshness checks can be bypassed, allowing certificate revocation to be...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +16646 more potentially affected by CVE-2025-66614 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=9.0.112)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2025-66614 Source advisory: SNYK:JAVA-ORGAPACHETOMCATEMBED-15307781...

cloud.subzero:subzero (>=2.0.8, <=3.0.1), cn.hiauth:hiauth-client-session-spring-boot-starter (3.0.0) +440 more potentially affected by CVE-2025-66614 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.14)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =2.0.8, =7.0.0-m1, =3.1.0, =3.0.0, =3.0.0, =4.0.0 - co.ipregistry:ipregistry-spring-boot-mvc 1.0.0 - co.ipregistry:ipregistry-spring-boot-webflux 1.0.0 - com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-model-chat-memory-mem0...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +13603 more potentially affected by CVE-2026-24733 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.112)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2026-24733 Source advisory: SNYK:JAVA-ORGAPACHETOMCATEMBED-15307825...

cloud.subzero:subzero (>=2.0.8, <=3.0.1), cn.hiauth:hiauth-client-session-spring-boot-starter (3.0.0) +440 more potentially affected by CVE-2026-24733 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.14)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =2.0.8, =7.0.0-m1, =3.1.0, =3.0.0, =3.0.0, =4.0.0 - co.ipregistry:ipregistry-spring-boot-mvc 1.0.0 - co.ipregistry:ipregistry-spring-boot-webflux 1.0.0 - com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-model-chat-memory-mem0...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +8307 more potentially affected by CVE-2026-24733 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.49)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-24733 Source advisory:...

wagtail-stacks-embed (>=0.1.0, <=0.3.0) potentially affected by CVE-2026-25517 via wagtail (1.7.0)

wagtail PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-stacks-embed =0.1.0, =0.3.0 Source cves: CVE-2026-25517 Source advisory: OSV:GHSA-4QVV-G3VR-M348...

WordPress PowerBI Embed Reports plugin <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin PowerBI Embed Reports versions = 1.1.7...

Malicious Package

Overview dotenv-embed is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in dotenv-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bbecb8b9bb96fcd71af0764df5106d8163ccb94c21960bf858383ab85d10308 The package dotenv-embed was found to contain malicious code. Source: ghsa-malware eb5a7942b654b4da1fb16e67f19ca82b3b52c4fcce4db85e9d5596571651c6b7 A...

MAL-2026-589 Malicious code in dotenv-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bbecb8b9bb96fcd71af0764df5106d8163ccb94c21960bf858383ab85d10308 The package dotenv-embed was found to contain malicious code. Source: ghsa-malware eb5a7942b654b4da1fb16e67f19ca82b3b52c4fcce4db85e9d5596571651c6b7 A...

CVE-2026-1389: Authorization Bypass Through User-Controlled Key

The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4. This is due to the plugin not verifying that a user has permission to access the requested resource in the...

CVE-2025-14941

The GZSEO plugin for WordPress is vulnerable to authorization bypass leading to Stored Cross-Site Scripting in all versions up to, and including, 2.0.11. This is due to missing capability checks on multiple AJAX handlers combined with insufficient input sanitization and output escaping on the...

CVE-2025-14941

The GZSEO plugin for WordPress is vulnerable to authorization bypass leading to Stored Cross-Site Scripting in all versions up to, and including, 2.0.11. This is due to missing capability checks on multiple AJAX handlers combined with insufficient input sanitization and output escaping on the...