CVE-2026-41001 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Boot [CVE-2026-40992, CVE-2026-41001]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Boot due to flaws in Mail auto-configuration and ArtemisEmbeddedConfigurationFactory CVE-2026-40992, CVE-2026-41001. Spring Boot is used as part of our microservices. These vulnerabilities have been addressed...

ai.platon.pulsar:browser4-boot (>=4.13.5, <=4.14.3), ai.platon.pulsar:browser4-captcha (>=4.13.5, <=4.14.3) +6714 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=4.0.0, <=4.0.6)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =4.0.0, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2, =4.14.0-rc.2, =4.5.0, =4.6.0 and more Source cves: CVE-2026-41001 Source advisory: OSV:GHSA-GGG2-9786-HWC8...

ai.platon.pulsar:browser4-boot (>=4.13.5, <=4.14.3), ai.platon.pulsar:browser4-captcha (>=4.13.5, <=4.14.3) +6714 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=4.0.0, <=4.0.6)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =4.0.0, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2, =4.14.0-rc.2, =4.5.0, =4.6.0 and more Source cves: CVE-2026-41001 Source advisory: GHSA-GGG2-9786-HWC8...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10815 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.5.0, <=3.5.14)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.5.0, =0.1.0, =0.1.0, =1.0.0-beta, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.8.4 and more Source cves: CVE-2026-41001 Source advisory: OSV:GHSA-GGG2-9786-HWC8...

CVE-2026-41001 Predictable Temp Directory in Artemis Auto-configuration

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts...

ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0, <=0.3.0) +759 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=4.1.0-m1, <=4.1.0-rc1)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =4.1.0-m1, =0.1.0, =0.1.0, =1.0.0-m1, =1.0.0-m1, =1.10.9, =1.10.9, =1.0.0, =1.0.2 - com.vaadin:copilot 25.2.0-beta1 - com.vaadin:hilla-endpoint 25.2.0-beta1 - com.vaadin:hilla-spring-boot-starter 25.2.0-beta1 -...