CVE-2026-40992

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4...

MAL-2026-5589 Malicious code in 0x2ai-demo2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98ee2445b2f0b01d2457cf45c188b310f58c98f3b676032f9c6213469f071239 On npm install, scripts/postinstall.cjs recursively copies the bundled payload/ directory into INITCWD the developer's project root via fs.cpSync. Th...

EUVD-2026-36211

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts...

CVE-2026-41001

CVE-2026-41001 affects Spring Boot’s ArtemisEmbeddedConfigurationFactory, which uses a fixed, static path for the embedded Artemis broker data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before appli...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10789 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.5.0, <=3.5.14)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.5.0, =0.1.0, =0.1.0, =1.0.0-beta, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.8.4 and more Source cves: CVE-2026-41001 Source advisory: MEND:CVE-2026-41001...

CVE-2026-41001

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts...

CVE-2026-41001 Predictable Temp Directory in Artemis Auto-configuration

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts...

ai.platon.pulsar:browser4-boot (>=4.13.5, <=4.14.0-rc.2), ai.platon.pulsar:browser4-captcha (>=4.13.5, <=4.14.0-rc.2) +6697 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=4.0.0, <=4.0.6)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =4.0.0, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-41001 Source advisory: MEND:CVE-2026-41001...

CVE-2026-41001 Predictable Temp Directory in Artemis Auto-configuration

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts...

CVE-2026-40992

CVE-2026-40992 concerns Spring Boot's Mail auto-configuration not enabling hostname verification by default. Affected: Spring Boot 4.0.0–4.0.6; 3.5.0–3.5.14; 3.4.0–3.4.16. The issue: hostname verification is not enabled; applications that explicitly set spring.mail.properties.mail.smtp.ssl.checks...

cc.cloudpivot.starter:cloudpivot-starter-messaging-mail (>=1.0.0, <=1.0.3), cn.net.rjnetwork:social-sdk-xianyu-manager (>=0.0.2, <=0.0.7) +523 more potentially affected by CVE-2026-40992 via org.springframework.boot:spring-boot-starter-mail (>=3.5.0, <=3.5.14)

org.springframework.boot:spring-boot-starter-mail MAVEN version =3.5.0, =1.0.0, =0.0.2, =3.5.5, =0.0.19, =0.0.19, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.12.0 and more Source cves: CVE-2026-40992 Source advisory: MEND:CVE-2026-40992...

cl.kanopus.tool:ktool-pulse (>=1.0.0, <=2.1.0), cloud.lildworks.ldu.springboot:ldu-springboot-mail-sender (4.0.6.2606.0) +336 more potentially affected by CVE-2026-40992 via org.springframework.boot:spring-boot-starter-mail (>=4.0.0, <=4.0.6)

org.springframework.boot:spring-boot-starter-mail MAVEN version =4.0.0, =1.0.0, =v2.0.0, =2.83.0, =2.79.0, =2.78.0, =2.71.0, =2.74.0, =3.33.0, =2.70.0, =1.52.0, =5.0.4, =4.8.0-chi-rc, =4.8.2-chi and more Source cves: CVE-2026-40992 Source advisory: MEND:CVE-2026-40992...

CVE-2026-40992 Mail Auto-Configuration Does Not Enable SSL Hostname Verification

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4...

EUVD-2026-36203

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4...

CVE-2026-40992

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4...

CVE-2026-40992 Mail Auto-Configuration Does Not Enable SSL Hostname Verification

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4...

CVE-2026-40992 Mail Auto-Configuration Does Not Enable SSL Hostname Verification

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4...

CVE-2026-41001: Insecure Temporary File

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts...

CVE-2026-40992: Improper Certificate Validation

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4...

PT-2026-80277

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts...