ai.foremast.metrics:foremast-spring-boot-15x-starter (0.1.8), at.researchstudio.sat:won-matcher (>=0.4, <=0.6) +174 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.17.release)

org.springframework.boot:spring-boot MAVEN version 1.5.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter 0.1.8 -...

br.com.ideotech:draw-out-spring-boot-aop (>=1.5.19.release, <=1.5.19-4.release), br.com.ideotech:draw-out-spring-boot-lib (>=1.5.19.release, <=1.5.19-4.release) +267 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.19.release)

org.springframework.boot:spring-boot MAVEN version 1.5.19.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - br.com.ideotech:draw-out-spring-boot-aop =1.5.19.release, =1.5.19.release,...

cn.skylarkai:license (>=1.0.0, <=1.0.2), com.eworkcloud:ework-cloud-starter-web (>=1.0.0, <=1.8.1) +175 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.20.release)

org.springframework.boot:spring-boot MAVEN version 1.5.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cn.skylarkai:license =1.0.0, =1.0.0, =3.1.1.release, =2.2.0.release,...

cn.com.365trade.oss:xxl-job-admin (>=2.2.1_zzlh, <=2.2.1.1_zzlh), cn.hippo4j:hippo4j-config-spring-boot-1x-starter (>=1.4.2, <=1.5.0) +439 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.22.release)

org.springframework.boot:spring-boot MAVEN version 1.5.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cn.com.365trade.oss:xxl-job-admin =2.2.1zzlh, =1.4.2, =a.1.1.1, =a.1.1.1,...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (0.28.0) +8616 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.3.0, <=3.3.13)

org.springframework.boot:spring-boot MAVEN version =3.3.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-40973 Source advisory: OSV:GHSA-WWPQ-F5C3-7HVX...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (0.28.0) +8616 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.3.0, <=3.3.13)

org.springframework.boot:spring-boot MAVEN version =3.3.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-40973 Source advisory: GHSA-WWPQ-F5C3-7HVX...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.114.0, <=0.120.0) +9138 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot MAVEN version =3.4.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.29 and more Source cves: CVE-2026-40973 Source advisory: OSV:GHSA-WWPQ-F5C3-7HVX...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.114.0, <=0.120.0) +9138 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot MAVEN version =3.4.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.29 and more Source cves: CVE-2026-40973 Source advisory: GHSA-WWPQ-F5C3-7HVX...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10548 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.5.0, <=3.5.13)

org.springframework.boot:spring-boot MAVEN version =3.5.0, =0.1.0, =0.1.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.6.0, =0.0.2, =0.8.4 and more Source cves: CVE-2026-40973 Source advisory: OSV:GHSA-WWPQ-F5C3-7HVX...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10548 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.5.0, <=3.5.13)

org.springframework.boot:spring-boot MAVEN version =3.5.0, =0.1.0, =0.1.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.6.0, =0.0.2, =0.8.4 and more Source cves: CVE-2026-40973 Source advisory: GHSA-WWPQ-F5C3-7HVX...

ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0, <=0.3.0) +5517 more potentially affected by CVE-2026-40976 via org.springframework.boot:spring-boot (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot MAVEN version =4.0.0, =0.1.0, =0.1.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.7.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-2, =2.0.0 and more Source cves: CVE-2026-40976 Source advisory: OSV:GHSA-8V8J-3HXP-93WR...

ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0, <=0.3.0) +5517 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot MAVEN version =4.0.0, =0.1.0, =0.1.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.7.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-2, =2.0.0 and more Source cves: CVE-2026-40973 Source advisory: OSV:GHSA-WWPQ-F5C3-7HVX...

ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0, <=0.3.0) +5517 more potentially affected by CVE-2026-40976 via org.springframework.boot:spring-boot (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot MAVEN version =4.0.0, =0.1.0, =0.1.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.7.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-2, =2.0.0 and more Source cves: CVE-2026-40976 Source advisory: GHSA-8V8J-3HXP-93WR...

ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0, <=0.3.0) +5517 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot MAVEN version =4.0.0, =0.1.0, =0.1.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.7.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-2, =2.0.0 and more Source cves: CVE-2026-40973 Source advisory: GHSA-WWPQ-F5C3-7HVX...

com.devskiller.friendly-id:friendly-id-openfeign (>=2.0.0-alpha3, <=2.0.0-beta6), io.github.bluetape4k:bluetape4k-spring-boot4-cassandra (>=1.5.0-beta2, <=1.7.0) +19 more potentially affected by CVE-2026-40975 via org.springframework.boot:spring-boot-cassandra (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot-cassandra MAVEN version =4.0.0, =2.0.0-alpha3, =1.5.0-beta2, =0.8.0, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-application (>=1.0.0, <=1.2.0) +37016 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=2.0.0.release, <=2.7.18)

org.springframework.boot:spring-boot MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.0, =4.6.0.0 and more Source cves: CVE-2026-40973 Source advisory: OSV:GHSA-WWPQ-F5C3-7HVX...

au.com.dius.pact.provider:spring (>=4.1.0, <=4.1.6), au.com.dius:pact-jvm-provider-spring (>=4.0.0-beta.1, <=4.0.10) +347 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.16.release)

org.springframework.boot:spring-boot MAVEN version 1.5.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - au.com.dius.pact.provider:spring =4.1.0, =4.0.0-beta.1, =3.6.0-rc.1, =3.6.15 -...

GHSA-8V8J-3HXP-93WR Spring Boot's default security filter chain has no authorization rule with Actuator but without Health

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter...

GHSA-WWPQ-F5C3-7HVX Spring Boot accepts predictable temp directory without ownership verification

A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack...

Spring Boot's PID file write follows symlinks at predictable default path

When an application is configured to use ApplicationPidFileWriter, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15 fix 3.4.16,...