com.github.yamingd.argo:argo-web (>=2.5.0, <=3.0.1), io.snappydata:gemfire-web (>=1.5.0-beta, <=2.0-beta) +29 more potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (3.2.12.release)

org.springframework:spring-webmvc MAVEN version 3.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.yamingd.argo:argo-web =2.5.0, =1.5.0-beta, =3.1.9-ga, =3.1.9-ga, =3.1.9-g...

com.sitewhere:sitewhere-activemq (1.4.0), com.sitewhere:sitewhere-azure (1.4.0) +21 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (3.2.10.release)

org.springframework:spring-webmvc MAVEN version 3.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.sitewhere:sitewhere-activemq 1.4.0 - com.sitewhere:sitewhere-azure 1.4.0 -...

com.sitewhere:sitewhere-activemq (>=1.0.2, <=1.4.0), com.sitewhere:sitewhere-azure (>=1.0.2, <=1.4.0) +27 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (3.2.10.release)

org.springframework:spring-jms MAVEN version 3.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - com.sitewhere:sitewhere-activemq =1.0.2, =1.0.2, =1.2.0, =1.0.2, =1.2.0, =1.0.2, =1.0.2,...

io.fabric8.examples:fabric-activemq-demo (1.2.0.redhat-133), io.fabric8.mq:camel-amq (1.2.0.redhat-133) +6 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (3.2.12.release)

org.springframework:spring-jms MAVEN version 3.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - io.fabric8.examples:fabric-activemq-demo 1.2.0.redhat-133 - io.fabric8.mq:camel-amq...

org.broadleafcommerce:broadleaf-admin-module (>=3.0.0-ga, <=3.0.2-ga), org.broadleafcommerce:broadleaf-common (>=3.0.0-ga, <=3.1.2-ga) +8 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (3.2.2.release)

org.springframework:spring-jms MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.broadleafcommerce:broadleaf-admin-module =3.0.0-ga, =3.0.0-ga, =3.0.0-ga, =3.0.0-ga,...

com.github.yamingd.argo:argo-web (>=2.5.0, <=3.0.1), io.snappydata:gemfire-web (>=1.5.0-beta, <=2.0-beta) +29 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (3.2.12.release)

org.springframework:spring-webmvc MAVEN version 3.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.yamingd.argo:argo-web =2.5.0, =1.5.0-beta, =3.1.9-ga, =3.1.9-ga, =3.1.9-g...

com.github.yamingd.argo:argo-web (>=2.5.0, <=3.0.1), io.snappydata:gemfire-web (>=1.5.0-beta, <=2.0-beta) +29 more potentially affected by CVE-2026-41844 via org.springframework:spring-webmvc (3.2.12.release)

org.springframework:spring-webmvc MAVEN version 3.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.yamingd.argo:argo-web =2.5.0, =1.5.0-beta, =3.1.9-ga, =3.1.9-ga, =3.1.9-g...

com.sitewhere:sitewhere-activemq (1.4.0), com.sitewhere:sitewhere-azure (1.4.0) +21 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (3.2.10.release)

org.springframework:spring-webmvc MAVEN version 3.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.sitewhere:sitewhere-activemq 1.4.0 - com.sitewhere:sitewhere-azure 1.4.0 -...

com.github.dandelion:datatables-thymeleaf (>=0.9.0, <=0.9.2), nz.net.ultraq.thymeleaf:thymeleaf-layout-dialect (>=1.1, <=1.1.3) +10 more potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.0.17)

org.thymeleaf:thymeleaf MAVEN version 2.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - com.github.dandelion:datatables-thymeleaf =0.9.0, =1.1, =3.0.0-ga, =3.0.0-ga, =3.0.0-ga, =3.0.0-ga, =3.0.0-ga,...

com.github.yamingd.argo:argo-web (>=2.5.0, <=3.0.1), io.snappydata:gemfire-web (>=1.5.0-beta, <=2.0-beta) +29 more potentially affected by CVE-2026-22745 via org.springframework:spring-webmvc (3.2.12.release)

org.springframework:spring-webmvc MAVEN version 3.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.yamingd.argo:argo-web =2.5.0, =1.5.0-beta, =3.1.9-ga, =3.1.9-ga, =3.1.9-g...

com.sitewhere:sitewhere-activemq (1.4.0), com.sitewhere:sitewhere-azure (1.4.0) +21 more potentially affected by CVE-2026-22745 via org.springframework:spring-webmvc (3.2.10.release)

org.springframework:spring-webmvc MAVEN version 3.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.sitewhere:sitewhere-activemq 1.4.0 - com.sitewhere:sitewhere-azure 1.4.0 -...

com.sitewhere:sitewhere-activemq (1.4.0), com.sitewhere:sitewhere-azure (1.4.0) +21 more potentially affected by CVE-2026-22741 via org.springframework:spring-webmvc (3.2.10.release)

org.springframework:spring-webmvc MAVEN version 3.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.sitewhere:sitewhere-activemq 1.4.0 - com.sitewhere:sitewhere-azure 1.4.0 -...

org.broadleafcommerce:broadleaf-common (>=3.0.11-ga, <=3.0.16-ga), org.broadleafcommerce:broadleaf-contentmanagement-module (>=3.0.11-ga, <=3.0.16-ga) +8 more potentially affected by CVE-2026-40478 via org.thymeleaf:thymeleaf (2.0.20)

org.thymeleaf:thymeleaf MAVEN version 2.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.broadleafcommerce:broadleaf-common =3.0.11-ga, =3.0.11-ga, =3.0.11-ga, =3.0.11-ga, =3.0.11-ga, =2.0.8, =2.0....

net.sourceforge.html5valdialect:html5valdialect (>=1.0.0-beta1, <=1.0.0-beta3), net.sourceforge.pagesdialect:pagesdialect-core (1.0.0-beta4) +13 more potentially affected by CVE-2026-40477 via org.thymeleaf:thymeleaf (2.0.13)

org.thymeleaf:thymeleaf MAVEN version 2.0.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - net.sourceforge.html5valdialect:html5valdialect =1.0.0-beta1, =2.0.0-ga, =2.0.0-ga, =2.0.0-ga, =2.0.0-ga,...

EUVD-2020-14039

Malware in sbrugna...

EUVD-2023-1667

Malicious code in bioql PyPI...

CVE-2023-33725

Broadleaf 5.x and 6.x including 5.2.25-GA and 6.2.6-GA was discovered to contain a cross-site scripting XSS vulnerability via a customer signup with a crafted email address. This is fixed in 6.2.6.1-GA...

CVE-2020-21266

Broadleaf Commerce 5.1.14-GA is affected by cross-site scripting XSS due to a slow HTTP post vulnerability...

com.github.yamingd.argo:argo-web (>=2.5.0, <=3.0.1), io.snappydata:gemfire-web (>=1.5.0-beta, <=2.0-beta) +29 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (3.2.12.release)

org.springframework:spring-webmvc MAVEN version 3.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.yamingd.argo:argo-web =2.5.0, =1.5.0-beta, =3.1.9-ga, =3.1.9-ga, =3.1.9-g...

GHSA-3862-FMR3-4F3H Broadleaf vulnerable to Cross-site Scripting

Broadleaf 5.x and 6.x including 5.2.25-GA and 6.2.6-GA was discovered to contain a cross-site scripting XSS vulnerability via a customer signup with a crafted email address. This is fixed in 6.2.7-GA...