cn.hdfk7.boot:hdfk7-boot-starter-common (4.0.0), com.avides.spring:spring-rabbit (5.0.0-rc1) +106 more potentially affected by CVE-2026-47860 via org.springframework.amqp:spring-amqp (4.1.0)

org.springframework.amqp:spring-amqp MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - cn.hdfk7.boot:hdfk7-boot-starter-common 4.0.0 - com.avides.spring:spring-rabbit 5.0.0-r...

cn.hdfk7.boot:hdfk7-boot-starter-common (4.0.0), com.avides.spring:spring-rabbit (5.0.0-rc1) +106 more potentially affected by CVE-2026-59275 via org.springframework.amqp:spring-amqp (4.1.0)

org.springframework.amqp:spring-amqp MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - cn.hdfk7.boot:hdfk7-boot-starter-common 4.0.0 - com.avides.spring:spring-rabbit 5.0.0-r...

cn.structured:structure-audit-application (v2.0.0), cn.structured:structure-audit-infra (v2.0.0) +103 more potentially affected by CVE-2026-59272 via org.springframework.amqp:spring-rabbit (>=4.0.0-m1, <=4.0.4)

org.springframework.amqp:spring-rabbit MAVEN version =4.0.0-m1, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-59272 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-19267969...

cn.hdfk7.boot:hdfk7-boot-starter-common (4.0.0), com.avides.spring:spring-rabbit (5.0.0-rc1) +102 more potentially affected by CVE-2026-59272 via org.springframework.amqp:spring-rabbit (4.1.0)

org.springframework.amqp:spring-rabbit MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-rabbit and may be impacted: - cn.hdfk7.boot:hdfk7-boot-starter-common 4.0.0 - com.avides.spring:spring-rabbit...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +20410 more potentially affected by CVE-2026-47885 via org.springframework:spring-web (>=6.1.0, <=7.0.8)

org.springframework:spring-web MAVEN version =6.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.0.1, =0.1.4 and more Source cves: CVE-2026-47885 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267077...

cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification

cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification...

cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler

cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler...

ai.authplane.sdk:authplane-spring (>=0.1.0, <=0.3.0), ai.loomspan:loomspan-spring-boot-starter (>=1.0.0-beta.1, <=1.0.0-beta.8) +1692 more potentially affected by CVE-2026-59277 via org.springframework.security:spring-security-core (7.1.0)

org.springframework.security:spring-security-core MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - ai.authplane.sdk:authplane-spring =0.1.0, =1.0.0-beta.1,...

Access Control Bypass

Overview org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Access Control Bypass in the InetAddressMatchers process. An attacker can bypass network-based access control...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the evaluation of user-supplied SpEL expressions containing the power operator ^ with a BigDecimal or BigInteger operand and a large exponent value. An attacker can cause excessive...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +15236 more potentially affected by CVE-2026-47889 via org.springframework:spring-web (>=6.2.0, <=7.0.8)

org.springframework:spring-web MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.5.7 and more Source cves: CVE-2026-47889 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267079...

com.limemojito.oss.standards.aws:lambda-sql (>=13.0.2, <=18.0.300), com.limemojito.oss.standards.aws:lambda-utilities (>=13.0.2, <=18.0.300) +50 more potentially affected by CVE-2026-59300 via org.springframework.cloud:spring-cloud-function-adapter-aws (>=5.0.0-m1, <=5.0.3)

org.springframework.cloud:spring-cloud-function-adapter-aws MAVEN version =5.0.0-m1, =13.0.2, =13.0.2, =13.0.2, =13.0.2, =13.0.2, =13.0.2, =0.40.0, =0.40.0, =0.27.2, =0.27.2, =0.27.2, =0.40.0, =0.39.0, =0.39.0, =0.27.2, =0.43.0 and more Source cves: CVE-2026-59300 Source advisory:...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.ancf.lmos:lmos-operator (>=0.5.0, <=0.6.0) +9615 more potentially affected by CVE-2026-47890 via org.springframework:spring-webmvc (>=6.2.0, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =6.2.0, =0.5.0, =0.1.2, =0.1.3, =0.1.0, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.29 and more Source cves: CVE-2026-47890 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267094...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +11893 more potentially affected by CVE-2026-47886 via org.springframework:spring-expression (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-expression MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.1.1-beta, =1.1.1-beta, =1.1.1-beta, =1.3.0-beta and more Source cves: CVE-2026-47886 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267073...

Missing Release of Resource after Effective Lifetime

Overview org.springframework:spring-messaging is a framework and inversion of control container for the Java platform. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the RSocketMessageHandler process when handling a malformed SETUP...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the SimpleEvaluationContext file when the SpEL expression compiler is enabled through specific configuration settings. An attacker can cause unbounded class-loading growth and bypa...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +10009 more potentially affected by CVE-2026-47888 via org.springframework:spring-messaging (>=5.2.0.release, <=7.0.8)

org.springframework:spring-messaging MAVEN version =5.2.0.release, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.0.1, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.9.2 and more Source cves: CVE-2026-47888 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267440https://vulners.com/snyk...

org.apereo.cas:cas-server-support-jpa-ticket-registry (>=8.0.0-rc6, <=8.0.2), org.eclipse.hawkbit:hawkbit-ddi-server (1.1.0) +10 more potentially affected by CVE-2026-59307 via org.springframework.integration:spring-integration-jdbc (7.1.0)

org.springframework.integration:spring-integration-jdbc MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-jdbc and may be impacted: -...

org.springframework.cloud.fn:spring-syslog-supplier (6.0.0) potentially affected by CVE-2026-47859 via org.springframework.integration:spring-integration-syslog (7.0.4)

org.springframework.integration:spring-integration-syslog MAVEN version 7.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-syslog and may be impacted: -...

org.springframework.cloud.fn:spring-syslog-supplier (6.0.0), org.springframework.cloud.fn:spring-tcp-common (6.0.0) +7 more potentially affected by CVE-2026-47861 via org.springframework.integration:spring-integration-ip (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-ip MAVEN version =7.0.0-m1, =7.0.0-m1, =7.0.5 Source cves: CVE-2026-47861 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKINTEGRATION-19267411...