ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +7685 more potentially affected by CVE-2025-48989 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.43)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-48989 Source advisory:...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +7685 more potentially affected by CVE-2025-48989 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.43)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-48989 Source advisory: GHSA-GQP3-2CVR-X8M3...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +13582 more potentially affected by CVE-2025-55668 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.105)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2025-55668 Source advisory: SNYK:JAVA-ORGAPACHETOMCATEMBED-11798986...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +7685 more potentially affected by CVE-2025-48989 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.43)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-48989 Source advisory: OSV:GHSA-GQP3-2CVR-X8M3...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +7103 more potentially affected by CVE-2025-55668 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.41)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-55668 Source advisory:...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +13583 more potentially affected by CVE-2025-48989 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.107)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2025-48989 Source advisory: SNYK:JAVA-ORGAPACHETOMCATEMBED-11799152...

Session Fixation

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Session Fixation via the rewrite valve if enabled for a web application. An attacker can gain unauthorized access to another user's session by crafting a request...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +13582 more potentially affected by CVE-2025-55668 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.105)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2025-55668 Source advisory: GHSA-23HV-MWM6-G8JF...

cn.hutool.v7:hutool-http (7.0.0-m1), cn.labzen:logger (1.6.0) +120 more potentially affected by CVE-2025-48989 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.9)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =3.1.9, =3.3.0-1231, =3.3.0-1231, =5.0.59, =13.2, =1.0.0, =1.1.6 - com.okta.idx.sdk:okta-idx-java-embedded-auth-with-sdk 4.0.1 - com.okta.idx.sdk:okta-idx-java-embedded-sign-in-widget 4.0.1 -...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +7103 more potentially affected by CVE-2025-55668 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.41)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-55668 Source advisory: GHSA-23HV-MWM6-G8JF...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +7103 more potentially affected by CVE-2025-55668 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.41)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-55668 Source advisory: MEND:CVE-2025-55668...

com.cleverpine:cp-virava-spring-helper (>=3.1.9, <=3.1.10), com.github.cafdataprocessing.services.staging:staging-service (>=3.3.0-1231, <=3.3.4-1288) +76 more potentially affected by CVE-2025-55668 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.7)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =3.1.9, =3.3.0-1231, =3.3.0-1231, =5.0.59, =13.2, =1.0.0, =1.1.6 - com.okta.spring.examples:okta-spring-boot-cloud-config-example 3.0.8 - com.okta.spring.examples:okta-spring-boot-hosted-code-flow-example 3.0.8 -...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +13582 more potentially affected by CVE-2025-55668 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.105)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2025-55668 Source advisory: MEND:CVE-2025-55668...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +13583 more potentially affected by CVE-2025-48989 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.107)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2025-48989 Source advisory: MEND:CVE-2025-48989...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +7685 more potentially affected by CVE-2025-48989 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.43)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-48989 Source advisory: MEND:CVE-2025-48989...

cn.hutool.v7:hutool-http (7.0.0-m1), cn.labzen:logger (1.6.0) +120 more potentially affected by CVE-2025-48989 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.9)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =3.1.9, =3.3.0-1231, =3.3.0-1231, =5.0.59, =13.2, =1.0.0, =1.1.6 - com.okta.idx.sdk:okta-idx-java-embedded-auth-with-sdk 4.0.1 - com.okta.idx.sdk:okta-idx-java-embedded-sign-in-widget 4.0.1 -...

Malicious code in @seznam-diskuze/embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 03c95e188163b615484b4882358ea8d4a9411661fa3bb701052fd608c8f6c4b7 The OpenSSF Package Analysis project identified '@seznam-diskuze/embed' @ 100.2.0 npm as malicious. It is considered malicious because: - The...

MAL-2025-6828 Malicious code in @seznam-diskuze/embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 03c95e188163b615484b4882358ea8d4a9411661fa3bb701052fd608c8f6c4b7 The OpenSSF Package Analysis project identified '@seznam-diskuze/embed' @ 100.2.0 npm as malicious. It is considered malicious because: - The...

firefox: thunderbird: javascript: URLs executed on object and embed tags

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Firefox executed javascript: URLs when used in object and embed tags...

WordPress esri-map-view cross-site scripting vulnerability

WordPress esri-map-view is used to embed Esri/ArcGIS maps or scenes in websites. The plugin realizes map display through short code, supports selecting base map, setting initial view angle, adding custom layers, pop-up information window and other functions, and can embed preconfigured web maps o...