org.springframework:spring-aop (1.2.2), org.springframework:spring-beans (1.2.2) +10 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (1.2.2)

org.springframework:spring-core MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.springframework:spring-aop 1.2.2 - org.springframework:spring-beans 1.2.2 -...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +11342 more potentially affected by CVE-2026-41854 via org.springframework:spring-web (>=6.2.0, <=6.2.18)

org.springframework:spring-web MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.29 and more Source cves: CVE-2026-41854 Source advisory: GHSA-7M2P-62GW-P8QQ...

GHSA-X23C-287F-QQV5 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +11342 more potentially affected by CVE-2026-41854 via org.springframework:spring-web (>=6.2.0, <=6.2.18)

org.springframework:spring-web MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.29 and more Source cves: CVE-2026-41854 Source advisory: MEND:CVE-2026-41854...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +11342 more potentially affected by CVE-2026-41853 via org.springframework:spring-web (>=6.2.0, <=6.2.18)

org.springframework:spring-web MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.29 and more Source cves: CVE-2026-41853 Source advisory: MEND:CVE-2026-41853...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +11342 more potentially affected by CVE-2026-41845 via org.springframework:spring-web (>=6.2.0, <=6.2.18)

org.springframework:spring-web MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.29 and more Source cves: CVE-2026-41845 Source advisory: MEND:CVE-2026-41845...

CVE-2026-41844

A Spring MVC or Spring WebFlux application which configures a mapping for "/" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix. Affected versions: Spring Framework 7.0.0 through...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +11342 more potentially affected by CVE-2026-41840 via org.springframework:spring-web (>=6.2.0, <=6.2.18)

org.springframework:spring-web MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.29 and more Source cves: CVE-2026-41840 Source advisory: MEND:CVE-2026-41840...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7), ai.fastllm:agent-cli_3 (>=0.3.0, <=0.5.7) +4796 more potentially affected by CVE-2026-41840 via org.springframework:spring-web (>=7.0.0, <=7.0.7)

org.springframework:spring-web MAVEN version =7.0.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.1.0 and more Source cves: CVE-2026-41840 Source advisory: MEND:CVE-2026-41840...

CVE-2026-41840

Spring WebFlux applications are vulnerable to Denial of Service DoS attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +11342 more potentially affected by CVE-2026-41839 via org.springframework:spring-web (>=6.2.0, <=6.2.18)

org.springframework:spring-web MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.29 and more Source cves: CVE-2026-41839 Source advisory: MEND:CVE-2026-41839...

Spring Framework environment issue vulnerabilities

The Spring Framework is an application development framework developed by Spring in open source. Versions of the Spring Framework such as 7.0.0 and earlier, 6.2.0 and earlier, 6.1.0 and earlier, and 5.3.0 and earlier have environmental vulnerabilities. These vulnerabilities stem from the fact tha...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +16905 more potentially affected by CVE-2026-41839 via org.springframework:spring-web (>=6.1.0, <=6.2.18)

org.springframework:spring-web MAVEN version =6.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.5.0, =0.6.0, =0.6.0, =0.9.2 and more Source cves: CVE-2026-41839 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254128...

HTTP Request Smuggling

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to HTTP Request Smuggling. via multipart...

Missing Release of Memory after Effective Lifetime

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Missing Release of Memory after Effective...

Directory Traversal

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Directory Traversal via static resource...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +16905 more potentially affected by CVE-2026-41845 via org.springframework:spring-web (>=6.1.0, <=6.2.18)

org.springframework:spring-web MAVEN version =6.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.5.0, =0.6.0, =0.6.0, =0.9.2 and more Source cves: CVE-2026-41845 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17255245...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7), ai.fastllm:agent-cli_3 (>=0.3.0, <=0.5.7) +4837 more potentially affected by CVE-2026-41853 via org.springframework:spring-web (>=7.0.0-m1, <=7.0.7)

org.springframework:spring-web MAVEN version =7.0.0-m1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.1.0 and more Source cves: CVE-2026-41853 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254109...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +16905 more potentially affected by CVE-2026-41853 via org.springframework:spring-web (>=6.1.0, <=6.2.18)

org.springframework:spring-web MAVEN version =6.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.5.0, =0.6.0, =0.6.0, =0.9.2 and more Source cves: CVE-2026-41853 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254109...

Server-side Request Forgery (SSRF)

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via...