ai.ancf.lmos:arc-runner (>=0.1.1, <=0.112.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.4.0) +3438 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (>=3.0.0, <=3.3.13)

org.springframework.boot:spring-boot-starter-actuator MAVEN version =3.0.0, =0.1.1, =0.0.4, =0.1.0, =cloud-0.1, =7.0.0, =2.10.0, =3.6.0, =3.6.1 and more Source cves: CVE-2026-22733 Source advisory: GHSA-MGVC-8Q2H-5PGC...

cn.home1:oss-admin (>=1.0.6.oss, <=1.0.7.oss), cn.home1:oss-configserver (>=1.0.6.oss, <=1.0.7.oss) +635 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.4.1.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.4.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - cn.home1:oss-admin =1.0.6.oss, =1.0.6.oss,...

au.com.mountain-pass:hyperstate (>=4, <=9), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (0.0.15) +253 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.3.5.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - au.com.mountain-pass:hyperstate =4,...

cn.patterncat:event-trace-client (1.3.0), cn.patterncat:springboot-metrics-starter (>=0.0.1, <=0.0.8) +6 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.4.6.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.4.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - cn.patterncat:event-trace-client 1.3.0 -...

ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.4-sb1x, <=0.1.4-sb1x_6) +53 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.3.0.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

cn.home1:spring-cloud-config-monitor (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1) +313 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.5.12.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.5.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - cn.home1:spring-cloud-config-monitor =0.0.1,...

com.moelholm.tools:actuator-ui-dump (>=0.1, <=0.2), de.codecentric:spring-boot-admin-sample (1.2.4) +17 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.2.7.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.moelholm.tools:actuator-ui-dump =0.1,...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (1.0.4), de.codecentric:cxf-spring-boot-starter (1.0.8.release) +20 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.4.4.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

ai.platon.pulsar:pulsar-e2e-tests (>=4.5.0, <=4.6.0), ai.platon.pulsar:pulsar-it-tests (>=4.5.0, <=4.6.0) +689 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (>=4.0.0-m1, <=4.0.3)

org.springframework.boot:spring-boot-starter-actuator MAVEN version =4.0.0-m1, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =3.1.0, =4.1.0 and more Source cves: CVE-2026-22733 Source advisory: OSV:GHSA-MGVC-8Q2H-5PGC...

am.ik.home:uaa-server (>=1.0.0, <=1.2.0), cn.chendahai:rocketmq-console-alarm (1.0.3) +65 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.4.3.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.4.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - am.ik.home:uaa-server =1.0.0, =3.0.1.2,...

ai.ancf.lmos:arc-runner (>=0.1.1, <=0.112.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.4.0) +3438 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (>=3.0.0, <=3.3.13)

org.springframework.boot:spring-boot-starter-actuator MAVEN version =3.0.0, =0.1.1, =0.0.4, =0.1.0, =cloud-0.1, =7.0.0, =2.10.0, =3.6.0, =3.6.1 and more Source cves: CVE-2026-22733 Source advisory: OSV:GHSA-MGVC-8Q2H-5PGC...

cn.zhangfusheng:zfs-api-administrator-ui (1.0.2), cn.zhangfusheng:zfs-swagger-ui (1.0.2.web) +678 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.5.9.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.5.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - cn.zhangfusheng:zfs-api-administrator-ui 1.0....

com.brinkus.labs:labs-cloud-starter-neo4j (1.6.1), com.brinkus.labs:labs-cloud-starter-service (1.6.1) +310 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.5.7.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.5.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.brinkus.labs:labs-cloud-starter-neo4j 1.6...

cn.dubby:itbus (>=0.2.7, <=0.2.8), com.cedarsoftware:n-cube (>=4.0.6, <=4.0.16) +266 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.5.3.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - cn.dubby:itbus =0.2.7, =4.0.6, =1.0.7, =1.5.3...

Spring Boot has an Authentication Bypass under Actuator Health groups paths

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before...

CVE-2026-22733

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from...

CVE-2026-22733: Authentication Bypass Using an Alternate Path or Channel

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from...

PT-2026-26702

Name of the Vulnerable Software and Affected Versions barebox versions 2016.03.0 through 2025.09.2 barebox versions 2025.10.0 through 2026.03.0 Description barebox is a bootloader. When creating a FIT Firmware Image Table, the mkimage1 function sets the hashed-nodes property of the FIT signature...

CVE-2026-33243: Insufficient Verification of Data Authenticity

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 and the corresponding backport to 2025.09.3, an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-runner (>=0.114.0, <=0.120.0) +2204 more potentially affected by CVE-2026-22735 via org.springframework:spring-webflux (>=6.2.0, <=6.2.16)

org.springframework:spring-webflux MAVEN version =6.2.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.7.0 and more Source cves: CVE-2026-22735 Source advisory: MEND:CVE-2026-22735...