This Week in Spring - February 17th, 2026

Hi, Spring fans! Welcome to another rip-roaring installment of This Week in Spring! It's Lunar New Year or Chinese New Year for billions of people around the world and to those who celebrate, Happy Chinese/Lunar New Year 新年快乐! Or Happy Spring Festival 春节快乐! My favorite kind of festival! In honor ...

org.webjars.npm:jsrsasign-util (1.0.5) potentially affected by CVE-2026-4601 via org.webjars.npm:jsrsasign (11.1.0)

org.webjars.npm:jsrsasign MAVEN version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:jsrsasign and may be impacted: - org.webjars.npm:jsrsasign-util 1.0.5 Source cves: CVE-2026-4601 Source advisory:...

org.webjars.npm:jsrsasign-util (1.0.5) potentially affected by CVE-2026-4600 via org.webjars.npm:jsrsasign (11.1.0)

org.webjars.npm:jsrsasign MAVEN version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:jsrsasign and may be impacted: - org.webjars.npm:jsrsasign-util 1.0.5 Source cves: CVE-2026-4600 Source advisory:...

A Bootiful Podcast: Java Champion and hilarious friend, Richard Fichtner

Hi, Spring fans! I've been waiting for this episode for so long! Today, we're finally joined by my friend Richard Fichtner, who so took pity on my plight waiting for music to be added to the GraalVM that his company, XDev Software, created the music-maven-plugin, the best Maven plugin, ever! This...

org.webjars.npm:asn1.js (>=4.0.0, <=5.4.1), org.webjars.npm:asn1.js-rfc5280 (3.0.0) +26 more potentially affected by CVE-2026-2739 via org.webjars.npm:bn.js (>=4.11.6, <=5.2.0)

org.webjars.npm:bn.js MAVEN version =4.11.6, =4.0.0, =4.0.1, =4.0.0, =5.0.0, =6.2.3, =6.6.1 - org.webjars.npm:ethereum-cryptography 0.1.3 - org.webjars.npm:ethers 5.4.6 - org.webjars.npm:ethersprojectaddress 5.4.0 - org.webjars.npm:ethersprojectbignumber 5.4.1 and more Source cves: CVE-2026-2739...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +231 more potentially affected by CVE-2026-1518 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-1518 Source advisory: SNYK:JAVA-ORGKEYCLOAK-15170836...

org.webjars.npm:canvas (>=2.5.0, <=2.6.0), org.webjars.npm:color-thief (2.2.5) +12 more potentially affected by CVE-2026-24842 via org.webjars.npm:tar (>=0.1.20, <=4.4.19)

org.webjars.npm:tar MAVEN version =0.1.20, =2.5.0, =0.97.5, =0.2.0, =3.4.0, =0.6.19, =2.0.0, =3.1.4, =3.4.1 - org.webjars.npm:tar.gz 1.0.7 Source cves: CVE-2026-24842 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15127356...

be.cylab.mark:client (>=0.0.10, <=0.0.23), be.cylab.mark:example (>=0.0.22, <=0.0.23) +62 more potentially affected by CVE-2026-24802 via com.github.briandilley.jsonrpc4j:jsonrpc4j (>=1.0, <=1.6)

com.github.briandilley.jsonrpc4j:jsonrpc4j MAVEN version =1.0, =0.0.10, =0.0.22, =0.0.10, =0.0.1, =0.0.1.release, =0.1-alpha-1, =1.0.0, =1.0, =0.1.0, =1.0.0, =1.2.0, =1.7.1, =1.7.9 and more Source cves: CVE-2026-24802 Source advisory: SNYK:JAVA-COMGITHUBBRIANDILLEYJSONRPC4J-15127916...

com.github.liuyueyi.media:svg-core (>=2.5, <=3.0.0) potentially affected by CVE-2026-24807 via com.github.liuyueyi.media:batik-codec-fix (>=2.5, <=3.0.0)

com.github.liuyueyi.media:batik-codec-fix MAVEN version =2.5, =2.5, =3.0.0 Source cves: CVE-2026-24807 Source advisory: SNYK:JAVA-COMGITHUBLIUYUEYIMEDIA-15127915...

com.github.liuyueyi.media:svg-core (>=2.5, <=3.0.0) potentially affected by CVE-2026-24806 via com.github.liuyueyi.media:batik-codec-fix (>=2.5, <=3.0.0)

com.github.liuyueyi.media:batik-codec-fix MAVEN version =2.5, =2.5, =3.0.0 Source cves: CVE-2026-24806 Source advisory: SNYK:JAVA-COMGITHUBLIUYUEYIMEDIA-15127912...

com.foxinmy:easemob4j (>=1.1.0, <=1.1.3), com.foxinmy:umeng4j (>=1.1.0, <=1.1.3) +13 more potentially affected by CVE-2026-24819 via com.foxinmy:weixin4j-base (>=1.0, <=1.10.2)

com.foxinmy:weixin4j-base MAVEN version =1.0, =1.1.0, =1.1.0, =1.9.0, =1.4, =1.0, =1.9.0, =1.4, =1.0, =1.8.0, =1.0.9-release, =0.0.2, =0.0.3 - org.oxerr:spring-security-wechat-samples-helloworld 0.0.1 Source cves: CVE-2026-24819 Source advisory: SNYK:JAVA-COMFOXINMY-15128702...

org.webjars.npm:degenerator (4.0.4), org.webjars.npm:pac-resolver (6.0.2) +1 more potentially affected by CVE-2026-22709 via org.webjars.npm:vm2 (3.9.19)

org.webjars.npm:vm2 MAVEN version 3.9.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:vm2 and may be impacted: - org.webjars.npm:degenerator 4.0.4 - org.webjars.npm:pac-resolver 6.0.2 - org.webjars.npm:rocket.chatapps-engine 1.35.0...

org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-23957 via org.webjars.npm:seroval (1.2.1)

org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-23957 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054526...

org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-23956 via org.webjars.npm:seroval (1.2.1)

org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-23956 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054521...

cn.herodotus.engine:oauth2-authentication-autoconfigure (>=3.5.5.3, <=3.5.6.2), cn.herodotus.engine:oauth2-authorization-server-autoconfigure (>=3.3.0.5, <=3.5.5.2) +2 more potentially affected by CVE-2026-23967 via org.webjars.npm:sm-crypto (0.3.13)

org.webjars.npm:sm-crypto MAVEN version 0.3.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sm-crypto and may be impacted: - cn.herodotus.engine:oauth2-authentication-autoconfigure =3.5.5.3, =3.3.0.5, =3.3.0.5, =3.5.5.3, =3.5.6.2...

br.com.jarch:jarch-apt (>=20.3.0, <=24.1.0), br.com.jarch:jarch-core (>=20.3.0, <=24.1.0) +32 more potentially affected by CVE-2025-65482 via fr.opensagres.xdocreport:fr.opensagres.xdocreport.document.docx (>=0.9.5, <=2.2.0)

fr.opensagres.xdocreport:fr.opensagres.xdocreport.document.docx MAVEN version =0.9.5, =20.3.0, =20.3.0, =2.23.5, =24.2.0, =23.1.0, =2.23.0, =2.0, =2.0, =2.0, =2.2.4, =2.0, =2.2.4, =2.2.4, =2.2.4, =2.2.7 and more Source cves: CVE-2025-65482 Source advisory: SNYK:JAVA-FROPENSAGRESXDOCREPORT-1504671...

MiracleLinux 8 : maven:3.5 (AXSA:2022-3741:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3741:01 advisory. maven-shared-utils: Command injection via Commandline class CVE-2022-29599 Tenable has extracted the preceding description block directly from the MiracleLin...

MiracleLinux 8 : maven:3.6 (AXSA:2022-3738:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3738:01 advisory. maven-shared-utils: Command injection via Commandline class CVE-2022-29599 Tenable has extracted the preceding description block directly from the MiracleLin...

MiracleLinux 8 : maven:3.5 (AXSA:2022-3572:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3572:01 advisory. apache-httpclient: incorrect handling of malformed authority component in request URIs CVE-2020-13956 Tenable has extracted the preceding description block...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.1, <=1.2.2), com.webank.wedatasphere.dss:dss-apiservice-server (>=1.1.0, <=1.2.2) +192 more potentially affected by CVE-2025-29847 via org.apache.linkis:linkis-common (>=1.0.3, <=1.8.0)

org.apache.linkis:linkis-common MAVEN version =1.0.3, =1.1.1, =1.1.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.1.2, =1.0.1, =1.0.1, =1.1.0, =1.0.1, =1.0.1, =1.1.0, =1.1.0, =1.2.2 and more Source cves: CVE-2025-29847 Source advisory: SNYK:JAVA-ORGAPACHELINKIS-15035881https://vulners.com/snyk...