Spotweb <= 1.5.1 - Cross Site Scripting

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter. id: CVE-2021-40973 info: name: Spotweb = 1.5.1 - Cross Site Scripting author: theamanrawat severity:...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in spring boot (CVE-2026-40973, CVE-2026-40975, CVE-2026-40977)

Summary IBM Db2 Developer Extension is affected by vulnerability in spring boot CVE-2026-40973, CVE-2026-40975, CVE-2026-40977 Vulnerability Details CVEID:CVE-2026-40973 DESCRIPTION: A local attacker on the same host as the application may be able to take control of the directory used by...

CVE-2026-40973 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, thingsboard, conductor, apache-nifi-registry, conductor-fips, kafbat-ui, kafbat-ui-fips, zipkin, camunda-zeebe, nacos, nacos-docker...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.114.0, <=0.120.0) +9138 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot MAVEN version =3.4.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.29 and more Source cves: CVE-2026-40973 Source advisory: GHSA-WWPQ-F5C3-7HVX...

am.ik.blog:blog-domain (>=4.2.1, <=4.3.6), am.ik.blog:blog-mapper (>=4.4.1, <=4.5.0) +955 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.7.release)

org.springframework.boot:spring-boot MAVEN version 1.5.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - am.ik.blog:blog-domain =4.2.1, =4.4.1, =0.2.13, =0.2.13, =0.2.13, =0.2.13,...

at.researchstudio.sat:won-matcher (0.3), at.researchstudio.sat:won-owner-webapp (0.3) +799 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.3.release)

org.springframework.boot:spring-boot MAVEN version 1.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - at.researchstudio.sat:won-matcher 0.3 - at.researchstudio.sat:won-owner-webapp...

au.com.dius:pact-jvm-provider-spring_2.11 (>=3.4.0, <=3.5.18), au.com.dius:pact-jvm-provider-spring_2.12 (>=3.5.4-rc.0, <=3.5.18) +672 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.4.2.release)

org.springframework.boot:spring-boot MAVEN version 1.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - au.com.dius:pact-jvm-provider-spring2.11 =3.4.0, =3.5.4-rc.0, =0.9.0, =1.1,...

am.ik.home:uaa-server (>=1.0.0, <=1.2.0), cn.chendahai:rocketmq-console-alarm (1.0.3) +335 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.4.3.release)

org.springframework.boot:spring-boot MAVEN version 1.4.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - am.ik.home:uaa-server =1.0.0, =1.0, =1.0.1, =3.0.1.3, =3.0.1.9, =3.0.1.9, =3.0....

com.canoo.dolphin-platform:dolphin-platform-server-spring (>=0.6.1, <=0.8.6), com.canoo.dolphin-platform:dolphin-platform-spring-controller-tester (0.8.6) +183 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.2.2.release)

org.springframework.boot:spring-boot MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.canoo.dolphin-platform:dolphin-platform-server-spring =0.6.1, =0.6.1, =0.1,...

org.springframework.boot:spring-boot-actuator (1.1.0.release), org.springframework.boot:spring-boot-autoconfigure (1.1.0.release) +29 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.1.0.release)

org.springframework.boot:spring-boot MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - org.springframework.boot:spring-boot-actuator 1.1.0.release -...

au.com.mountain-pass:hyperstate-cert (>=1, <=10), au.com.mountain-pass:hyperstate-client (>=1, <=10) +524 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.4.0.release)

org.springframework.boot:spring-boot MAVEN version 1.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - au.com.mountain-pass:hyperstate-cert =1, =1, =1, =1, =1, =1, =0.1, =1.0.0-rc,...

cn.afterturn:easypoi-spring-boot-starter (>=0.2, <=3.3.0), co.paralleluniverse:comsat-spring-boot (0.5.0) +251 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.2.5.release)

org.springframework.boot:spring-boot MAVEN version 1.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cn.afterturn:easypoi-spring-boot-starter =0.2, =1.5.0, =2.0.2, =2.0.3, =2.0.2,...

cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure (1.0.2), cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure-amqp (1.0.2) +266 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.21.release)

org.springframework.boot:spring-boot MAVEN version 1.5.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure 1.0.2 -...

au.com.dius:pact-jvm-provider-spring_2.11 (>=3.5.19, <=3.5.24), au.com.dius:pact-jvm-provider-spring_2.12 (>=3.5.19, <=3.6.0-rc.0) +742 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.14.release)

org.springframework.boot:spring-boot MAVEN version 1.5.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - au.com.dius:pact-jvm-provider-spring2.11 =3.5.19, =3.5.19, =1.1.10, =1.5.14,...

com.ebay:lightning-client (0.9.0), com.ebay:lightning-core (0.9.0) +25 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.0.1.release)

org.springframework.boot:spring-boot MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.ebay:lightning-client 0.9.0 - com.ebay:lightning-core 0.9.0 -...

au.com.dius.pact.provider:spring (>=4.1.0, <=4.1.6), au.com.dius:pact-jvm-provider-spring (>=4.0.0-beta.1, <=4.0.10) +347 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.16.release)

org.springframework.boot:spring-boot MAVEN version 1.5.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - au.com.dius.pact.provider:spring =4.1.0, =4.0.0-beta.1, =3.6.0-rc.1, =3.6.15 -...

cc.ccoke:validate-spring-boot-starter (>=0.1, <=0.5), cc.zenfery:springboot-starter-mds (>=0.1.1, <=0.1.2) +209 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.4.4.release)

org.springframework.boot:spring-boot MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cc.ccoke:validate-spring-boot-starter =0.1, =0.1.1, =0.1.1, =1.23.0, =0.0.2,...

com.github.jlgrock.snp:client (0.1), com.github.jlgrock.snp:core (0.1) +78 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.2.0.release)

org.springframework.boot:spring-boot MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.github.jlgrock.snp:client 0.1 - com.github.jlgrock.snp:core 0.1 -...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10548 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.5.0, <=3.5.13)

org.springframework.boot:spring-boot MAVEN version =3.5.0, =0.1.0, =0.1.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.6.0, =0.0.2, =0.8.4 and more Source cves: CVE-2026-40973 Source advisory: OSV:GHSA-WWPQ-F5C3-7HVX...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10548 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.5.0, <=3.5.13)

org.springframework.boot:spring-boot MAVEN version =3.5.0, =0.1.0, =0.1.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.6.0, =0.0.2, =0.8.4 and more Source cves: CVE-2026-40973 Source advisory: GHSA-WWPQ-F5C3-7HVX...