Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Ironic vulnerabilities (USN-8421-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8421-1 advisory. Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not properly validate file paths when handling ISO images. ...

PT-2026-48929

Name of the Vulnerable Software and Affected Versions NanaZip versions 3.0.1000.0 through 6.0.1697.0 Description A heap out-of-bounds read exists in the Android Verified Boot AVB vbmeta image parser via the upstream 7-Zip AvbHandler. An unsigned integer underflow in a bounds check allows an...

PT-2026-48944

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot AVB vbmeta image parser in NanaZip via the upstream 7-Zip AvbHandler. A 32-bit unsigned integer overflow ...

USN-8421-1 ironic vulnerabilities

Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not properly validate file paths when handling ISO images. A privileged authenticated remote user could use this issue to perform path traversal via a crafted ISO image and overwrite arbitrary files on the Ironic conductor...

cybersec-bad-folio

DevFolio Application portfolio étudiant — Spring Boot 3.2 + V...

ai.platon.pulsar:browser4-boot (>=4.13.5, <=4.14.0-rc.2), ai.platon.pulsar:browser4-captcha (>=4.13.5, <=4.14.0-rc.2) +6697 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=4.0.0, <=4.0.6)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =4.0.0, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-41001 Source advisory: GHSA-GGG2-9786-HWC8...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.114.0, <=0.120.0) +8970 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.4.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.29 and more Source cves: CVE-2026-41001 Source advisory: OSV:GHSA-GGG2-9786-HWC8...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.114.0, <=0.120.0) +8970 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.4.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.29 and more Source cves: CVE-2026-41001 Source advisory: GHSA-GGG2-9786-HWC8...

ai.apiverse:apipulse (1.0.1), ai.chat2db.excel:easyexcel-plus-test (0.0.1) +13644 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=2.7.0, <=2.7.18)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =2.7.0, =0.18, =0.18, =0.18, =0.18, =0.18, =0.18, =0.18, =1.0, =0.8.38, =0.8.38, =v0.16.1, =v0.16.1, =v0.16.1, =v0.123.652 and more Source cves: CVE-2026-41001 Source advisory: GHSA-GGG2-9786-HWC8...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10789 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.5.0, <=3.5.14)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.5.0, =0.1.0, =0.1.0, =1.0.0-beta, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.8.4 and more Source cves: CVE-2026-41001 Source advisory: OSV:GHSA-GGG2-9786-HWC8...

ai.apiverse:apipulse (1.0.1), ai.chat2db.excel:easyexcel-plus-test (0.0.1) +13644 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=2.7.0, <=2.7.18)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =2.7.0, =0.18, =0.18, =0.18, =0.18, =0.18, =0.18, =0.18, =1.0, =0.8.38, =0.8.38, =v0.16.1, =v0.16.1, =v0.16.1, =v0.123.652 and more Source cves: CVE-2026-41001 Source advisory: OSV:GHSA-GGG2-9786-HWC8...

ai.platon.pulsar:browser4-boot (>=4.13.5, <=4.14.0-rc.2), ai.platon.pulsar:browser4-captcha (>=4.13.5, <=4.14.0-rc.2) +6697 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=4.0.0, <=4.0.6)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =4.0.0, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-41001 Source advisory: OSV:GHSA-GGG2-9786-HWC8...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (0.28.0) +8388 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.3.0, <=3.3.13)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.3.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41001 Source advisory: GHSA-GGG2-9786-HWC8...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (0.28.0) +8388 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.3.0, <=3.3.13)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.3.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41001 Source advisory: OSV:GHSA-GGG2-9786-HWC8...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10789 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.5.0, <=3.5.14)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.5.0, =0.1.0, =0.1.0, =1.0.0-beta, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.8.4 and more Source cves: CVE-2026-41001 Source advisory: GHSA-GGG2-9786-HWC8...

Spring Boot: Predictable Temp Directory in Artemis Auto-configuration

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts...

GHSA-GGG2-9786-HWC8 Spring Boot: Predictable Temp Directory in Artemis Auto-configuration

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts...

com.ahome-it:ahome-tooling-server-core (>=1.0.83-rc1, <=1.0.93-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.88-rc1, <=1.0.99-release) +6 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.1.5.release)

org.springframework.integration:spring-integration-file MAVEN version 4.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.ahome-it:ahome-tooling-server-core...

ai.intelliswarm:swarmai-eval (>=1.0.0, <=1.0.29), ai.intelliswarm:swarmai-rag (>=1.0.28, <=1.0.29) +472 more potentially affected by CVE-2026-40992 via org.springframework.boot:spring-boot-starter-mail (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot-starter-mail MAVEN version =3.4.0, =1.0.0, =1.0.28, =1.0.0, =3.2.5, =5.0.0-beta.4, =1.0.0, =1.0.1-jdk21, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.5 and more Source cves: CVE-2026-40992 Source advisory: GHSA-9WXP-W4PX-32VH...

org.springframework.boot:spring-boot-starter-integration (>=1.0.0.release, <=1.0.1.release), org.springframework.integration:spring-integration-ftp (3.0.1.release) +1 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (3.0.1.release)

org.springframework.integration:spring-integration-file MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...