cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay...

cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint

cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the ZipTransformer process. An attacker can overwrite or plant files in arbitrary directories by pre-creating a symbolic link at /tmp/ziptransformer before the application starts, causing extracted archive contents an...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the UnZipTransformer process. An attacker can exhaust system memory and cause service outages by submitting specially crafted zip archives with excessive decompressed...

Cleartext Transmission of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information via the negotiation process. An attacker can intercept or alter files transferred and capture authentication credentials by performing a downgrade attack on the SMB protocol. Remediation...

io.github.shuigedeng:taotao-cloud-demo (2025.12), io.github.shuigedeng:taotao-cloud-starter-alibaba (2025.12) +38 more potentially affected by CVE-2026-59298 via org.springframework.cloud:spring-cloud-function-web (>=5.0.0-m1, <=5.0.3)

org.springframework.cloud:spring-cloud-function-web MAVEN version =5.0.0-m1, =0.27.2, =0.27.2, =0.33.2, =0.33.2, =0.43.0 and more Source cves: CVE-2026-59298 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267406...

ch.nexsol-tech.gateway:config-server (>=1.6.0, <=1.7.0), net.sf.tsl2nano:tsl3-beanui (0.0.2) +6 more potentially affected by CVE-2026-47894 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.4)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =1.6.0, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.2 Source cves: CVE-2026-47894 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267446...

ch.nexsol-tech.gateway:config-server (>=1.6.0, <=1.7.0), net.sf.tsl2nano:tsl3-beanui (0.0.2) +6 more potentially affected by CVE-2026-47837 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.4)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =1.6.0, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.2 Source cves: CVE-2026-47837 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267445...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=4.0.0-alpha-springboot4, <=5.3.1), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=4.0.0-alpha-springboot4, <=5.3.1) +74 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (>=7.0.0, <=7.0.6)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =7.0.0, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =3.6.0, =3.5.0, =5.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =2.0.1 -...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=5.4.0, <=10.0.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=5.4.0, <=10.0.0) +80 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (7.1.0)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

cve-2026-47834 - MEDIUM - Spring Data JPA Sort expression validation bypass

cve-2026-47834 - MEDIUM - Spring Data JPA Sort expression validation bypass...

HTTP Response Splitting

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to HTTP Response Splitting via the...

cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests...

cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure

cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure...

cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation

cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation...

ai.authplane.sdk:authplane-spring (>=0.1.0, <=0.3.0), ai.loomspan:loomspan-spring-boot-starter (>=1.0.0-beta.1, <=1.0.0-beta.8) +1692 more potentially affected by CVE-2026-59276 via org.springframework.security:spring-security-core (7.1.0)

org.springframework.security:spring-security-core MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - ai.authplane.sdk:authplane-spring =0.1.0, =1.0.0-beta.1,...

ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +8385 more potentially affected by CVE-2026-59276 via org.springframework.security:spring-security-core (>=5.7.0, <=7.0.6)

org.springframework.security:spring-security-core MAVEN version =5.7.0, =cloud-0.1, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040,...

ai.authplane.sdk:authplane-spring (>=0.1.0, <=0.3.0), ai.loomspan:loomspan-spring-boot-starter (>=1.0.0-beta.1, <=1.0.0-beta.8) +1895 more potentially affected by CVE-2026-47842 via org.springframework.security:spring-security-crypto (7.1.0)

org.springframework.security:spring-security-crypto MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - ai.authplane.sdk:authplane-spring =0.1.0, =1.0.0-beta.1,...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.driftkit:driftkit-context-engineering-spring-ai-starter (>=0.6.0, <=0.7.5) +4134 more potentially affected by CVE-2026-47834 via org.springframework.data:spring-data-jpa (>=3.0.0, <=4.0.6)

org.springframework.data:spring-data-jpa MAVEN version =3.0.0, =0.1.0, =0.6.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.29 and more Source cves: CVE-2026-47834 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKDATA-19267482...

com.limemojito.oss.standards.aws:lambda-sql (>=13.0.2, <=18.0.300), com.limemojito.oss.standards.aws:lambda-utilities (>=13.0.2, <=18.0.300) +50 more potentially affected by CVE-2026-59300 via org.springframework.cloud:spring-cloud-function-adapter-aws (>=5.0.0-m1, <=5.0.3)

org.springframework.cloud:spring-cloud-function-adapter-aws MAVEN version =5.0.0-m1, =13.0.2, =13.0.2, =13.0.2, =13.0.2, =13.0.2, =13.0.2, =0.40.0, =0.40.0, =0.27.2, =0.27.2, =0.27.2, =0.40.0, =0.39.0, =0.39.0, =0.27.2, =0.43.0 and more Source cves: CVE-2026-59300 Source advisory:...