africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +22146 more potentially affected by CVE-2026-59313 via org.springframework:spring-webmvc (>=5.3.0, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =0.2.0, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo 0.1.0 - ai.apiprism:apiprism-spring-boot-starter 0.1.0 and more Source cves:...

ch.sbb:spring-cloud-stream-binder-solace (>=9.1.0, <=9.3.0), cn.herodotus.dante:dante-authentication-autoconfigure (4.1.0.1) +522 more potentially affected by CVE-2026-47856 via org.springframework.integration:spring-integration-core (7.1.0)

org.springframework.integration:spring-integration-core MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-core and may be impacted: - ch.sbb:spring-cloud-stream-binder-solace =9.1.0,...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3) +730 more potentially affected by CVE-2026-47856 via org.springframework.integration:spring-integration-core (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-core MAVEN version =7.0.0-m1, =8.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 -...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the decodeNativeFormat. An attacker can inject arbitrary entries into MessageHeaders, including sensitive control headers, by sending...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the ZipTransformer process. An attacker can overwrite or plant files in arbitrary directories by pre-creating a symbolic link at /tmp/ziptransformer before the application starts, causing extracted archive contents an...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the UnZipTransformer process. An attacker can exhaust system memory and cause service outages by submitting specially crafted zip archives with excessive decompressed...

Cleartext Transmission of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information via the negotiation process. An attacker can intercept or alter files transferred and capture authentication credentials by performing a downgrade attack on the SMB protocol. Remediation...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition via the ScriptEngine process. An attacker can access sensitive data from other requests or cause unexpected exceptions by triggering concurrent script evaluations. Remediation Upgrade...

ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +8366 more potentially affected by CVE-2026-59276 via org.springframework.security:spring-security-core (>=5.7.0, <=7.0.6)

org.springframework.security:spring-security-core MAVEN version =5.7.0, =cloud-0.1, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040,...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +12081 more potentially affected by CVE-2026-47842 via org.springframework.security:spring-security-crypto (>=5.7.0, <=7.0.6)

org.springframework.security:spring-security-crypto MAVEN version =5.7.0, =0.2.0, =0.5.0, =0.6.0, =0.5.0, =0.8.4, =0.8.4, =0.9.1, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.9.2 and more Source cves: CVE-2026-47842 Source advisory:...

ch.nexsol-tech.gateway:config-server (>=1.6.0, <=1.7.0), net.sf.tsl2nano:tsl3-beanui (0.0.2) +6 more potentially affected by CVE-2026-47836 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.4)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =1.6.0, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.2 Source cves: CVE-2026-47836 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267449...

Cross-site Scripting (XSS)

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the...

Generation of Predictable IV with CBC Mode

Overview org.springframework.security:spring-security-crypto is a spring-security-crypto library for Spring Security. Affected versions of this package are vulnerable to Generation of Predictable IV with CBC Mode via AesBytesEncryptor when using the two-argument constructor or specifying a null I...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the evaluation of user-supplied SpEL expressions containing the power operator ^ with a BigDecimal or BigInteger operand and a large exponent value. An attacker can cause excessive...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +9988 more potentially affected by CVE-2026-47888 via org.springframework:spring-messaging (>=5.2.0.release, <=7.0.8)

org.springframework:spring-messaging MAVEN version =5.2.0.release, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.0.1, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.9.2 and more Source cves: CVE-2026-47888 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267440https://vulners.com/snyk...

cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3), cn.herodotus.dante:dante-authorization-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3) +38 more potentially affected by CVE-2026-47841 via org.springframework.security:spring-security-webauthn (>=7.0.0, <=7.0.6)

org.springframework.security:spring-security-webauthn MAVEN version =7.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.2.0-m4, =4.0.2.0-m4, =4.0.0.0-m4, =4.0.0.0-m4, =4.1.0.0-m1 and more Sourc...

HTTP Response Splitting

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to HTTP Response Splitting via the...

Comparison of Object References Instead of Object Contents

Overview Affected versions of this package are vulnerable to Comparison of Object References Instead of Object Contents in the process of comparing UserVerificationRequirement during WebAuthn authentication, when using distributed HTTP session stores. An attacker can bypass user verification by...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions via the PropertiesPersistingMetadataStore. An attacker can access sensitive metadata, such as processed message keys, offsets, or idempotency markers, by reading the world-readable metadata file created in ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the RFC6587SyslogDeserializer. An attacker can cause excessive memory consumption and potentially exhaust system resources by sending frames with arbitrarily large declared lengths...