org.springframework.boot:spring-boot-docs (1.5.0.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.0.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.5.0.release Sourc...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=0.0.8, <=0.0.9), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=0.0.8, <=0.0.9) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.2.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.garethahealy.poms:springboot-parent (1.0.0), com.garethahealy:springboot-parent (>=1.1.0, <=1.1.1) +2 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.1.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.garethahealy.poms:springboot-parent 1.0.0 -...

io.fabric8:fabric8-maven-generator-spring-boot (>=3.1.66, <=3.1.70), io.fabric8:fabric8-maven-plugin (>=3.1.65, <=3.1.70) +1 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.7.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - io.fabric8:fabric8-maven-generator-spring-boot =3.1.66,...

com.avioconsulting.maven:ics-maven-plugin (1.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=0.0.2, <=0.0.5) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.0.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.avioconsulting.maven:ics-maven-plugin 1.0 -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=0.0.10, <=0.0.14), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=0.0.10, <=0.0.14) +10 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.3.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (0.0.15), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (0.0.15) +67 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.5.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (0.0.16), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (0.0.16) +103 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.0.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (1.0.4), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (1.0.4) +4 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.4.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

am.ik.home:uaa-server (>=1.0.0, <=1.2.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (1.0.3) +25 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.3.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - am.ik.home:uaa-server =1.0.0, =1.2.0 -...

org.springframework.boot:spring-boot-docs (1.4.6.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.6.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.4.6.release Sourc...

com.alibaba:tac-console (0.0.4), com.alibaba:tac-container (0.0.4) +1 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.7.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.alibaba:tac-console 0.0.4 - com.alibaba:tac-container 0.0...

org.springframework.boot:spring-boot-docs (1.5.5.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.5.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.5.5.release Sourc...

GHSA-56V8-86GJ-66JP Spring Boot DevTools remote secret comparison is vulnerable to timing attacks

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code executio...

am.ik.home:uaa-server (>=1.3.0, <=1.8.1), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (1.0.5) +28 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.1.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - am.ik.home:uaa-server =1.3.0, =1.8.1 -...

com.digitalsanctuary:ds-spring-user-framework (>=3.2.3, <=3.3.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=4.1.0, <=4.1.1) +42 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.5.0, <=3.5.11)

org.springframework.boot:spring-boot-devtools MAVEN version =3.5.0, =3.2.3, =4.1.0, =3.0.2g, =3.2.2, =1.1.1, =1.2.0 - de.tschuehly:spring-view-component-thymeleaf 0.9.0 - io.gitee.javakiller:wxz-common 2026.08.30-jdk17 - io.gitee.javakiller:wxz-common-web 2026.08.30-jdk17 -...

ai.hyacinth.framework:core-service-admin-server (0.5.24), ai.hyacinth.framework:core-service-config-server (0.5.24) +408 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=2.0.0.release, <=2.7.18)

org.springframework.boot:spring-boot-devtools MAVEN version =2.0.0.release, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =0.0.2, =0.0.3, =1.0.0, =1.0.5 - br.com.m4rc310:br-com-m4rc310-graphql 1.0.1 - br.com.m4rc310:br-com-m4rc310-libs 1.0.1 and more Sourc...

CVE-2026-40972

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code executio...

CVE-2026-40972: Observable Timing Discrepancy

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code executio...

PT-2026-46738

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description Insufficient policy enforcement in DevTools allows an attacker to leak cross-origin data. This occurs when a user is convinced to install a crafted malicious Chrome Extension...