Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the isSecure function of ServerlessHttpServletRequest due to not verifying the actual scheme. An attacker can potentially access or modify sensitive information by exploiting this improper security che...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper restriction of the dynamic destination cache size. An attacker can cause unintended information disclosure or modification by exploiting the lack of proper bounds on t...

Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...

Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...

cn.structured:structure-audit-application (v2.0.0), cn.structured:structure-audit-infra (v2.0.0) +106 more potentially affected by CVE-2026-59275 via org.springframework.amqp:spring-amqp (>=4.0.0-m1, <=4.0.4)

org.springframework.amqp:spring-amqp MAVEN version =4.0.0-m1, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-59275 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-19267465...

cn.hdfk7.boot:hdfk7-boot-starter-common (4.0.0), com.avides.spring:spring-rabbit (5.0.0-rc1) +106 more potentially affected by CVE-2026-59275 via org.springframework.amqp:spring-amqp (4.1.0)

org.springframework.amqp:spring-amqp MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - cn.hdfk7.boot:hdfk7-boot-starter-common 4.0.0 - com.avides.spring:spring-rabbit 5.0.0-r...

org.springframework.cloud:spring-cloud-stream-schema-registry-server (>=4.2.2, <=5.0.2) potentially affected by CVE-2026-59304 via org.springframework.cloud:spring-cloud-stream-schema-registry-core (>=4.2.2, <=5.0.2)

org.springframework.cloud:spring-cloud-stream-schema-registry-core MAVEN version =4.2.2, =4.2.2, =5.0.2 Source cves: CVE-2026-59304 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267416...

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting in the processing of HTTP headers. An attacker can inject or manipulate HTTP headers by sending specially crafted requests. Remediation Upgrade org.springframework.cloud:spring-cloud-function-web to version 5.0.4...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the setBeanClassLoader process. An attacker can execute arbitrary code by injecting malicious serialized data into the INTMESSAGE.MESSAGECONTENT field. This is only exploitable if the deserializatio...

io.github.shuigedeng:taotao-cloud-demo (2025.12), io.github.shuigedeng:taotao-cloud-starter-alibaba (2025.12) +38 more potentially affected by CVE-2026-59298 via org.springframework.cloud:spring-cloud-function-web (>=5.0.0-m1, <=5.0.3)

org.springframework.cloud:spring-cloud-function-web MAVEN version =5.0.0-m1, =0.27.2, =0.27.2, =0.33.2, =0.33.2, =0.43.0 and more Source cves: CVE-2026-59298 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267406...

ch.nexsol-tech.gateway:config-server (>=1.6.0, <=1.7.0), net.sf.tsl2nano:tsl3-beanui (0.0.2) +6 more potentially affected by CVE-2026-47837 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.4)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =1.6.0, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.2 Source cves: CVE-2026-47837 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267445...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=4.0.0-alpha-springboot4, <=5.3.1), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=4.0.0-alpha-springboot4, <=5.3.1) +74 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (>=7.0.0, <=7.0.6)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =7.0.0, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =3.6.0, =3.5.0, =5.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =2.0.1 -...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=5.4.0, <=10.0.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=5.4.0, <=10.0.0) +80 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (7.1.0)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.driftkit:driftkit-context-engineering-spring-ai-starter (>=0.6.0, <=0.7.5) +4134 more potentially affected by CVE-2026-47834 via org.springframework.data:spring-data-jpa (>=3.0.0, <=4.0.6)

org.springframework.data:spring-data-jpa MAVEN version =3.0.0, =0.1.0, =0.6.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.29 and more Source cves: CVE-2026-47834 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKDATA-19267482...

com.limemojito.oss.standards.aws:lambda-sql (>=13.0.2, <=18.0.300), com.limemojito.oss.standards.aws:lambda-utilities (>=13.0.2, <=18.0.300) +50 more potentially affected by CVE-2026-59300 via org.springframework.cloud:spring-cloud-function-adapter-aws (>=5.0.0-m1, <=5.0.3)

org.springframework.cloud:spring-cloud-function-adapter-aws MAVEN version =5.0.0-m1, =13.0.2, =13.0.2, =13.0.2, =13.0.2, =13.0.2, =13.0.2, =0.40.0, =0.40.0, =0.27.2, =0.27.2, =0.27.2, =0.40.0, =0.39.0, =0.39.0, =0.27.2, =0.43.0 and more Source cves: CVE-2026-59300 Source advisory:...

com.amazonaws.serverless:aws-serverless-java-container-springboot4 (>=3.0.0, <=3.0.3), org.springframework.cloud:spring-cloud-function-adapter-azure-web (>=4.2.0, <=5.0.3) potentially affected by CVE-2026-59297 via org.springframework.cloud:spring-cloud-function-serverless-web (>=4.2.0, <=5.0.3)

org.springframework.cloud:spring-cloud-function-serverless-web MAVEN version =4.2.0, =3.0.0, =4.2.0, =5.0.3 Source cves: CVE-2026-59297 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267419...

cn.net.pap.example:pap4j-boot3-example-spring-ai (0.0.4), com.redis.om:redis-om-spring-ai (>=1.0.0-rc2, <=2.0.10) +6 more potentially affected by CVE-2026-47852 via org.springframework.ai:spring-ai-transformers (>=1.0.0, <=2.0.0)

org.springframework.ai:spring-ai-transformers MAVEN version =1.0.0, =1.0.0-rc2, =0.0.4, =0.3.0, =0.0.1, =0.2.2, =1.0.0, =2.0.0 - site.addzero:ai-agent 2026.06.20 Source cves: CVE-2026-47852 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-19267427...

app.tozzi:jpa-search-helper (4.1.0), br.com.archbase:archbase-domain-driven-design (>=3.0.0, <=3.4.2) +885 more potentially affected by CVE-2026-47834 via org.springframework.data:spring-data-jpa (4.1.0)

org.springframework.data:spring-data-jpa MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-jpa and may be impacted: - app.tozzi:jpa-search-helper 4.1.0 - br.com.archbase:archbase-domain-driven-desi...

ai.authplane.sdk:authplane-spring (>=0.1.0, <=0.3.0), ai.loomspan:loomspan-spring-boot-starter (>=1.0.0-beta.1, <=1.0.0-beta.8) +1692 more potentially affected by CVE-2026-59277 via org.springframework.security:spring-security-core (7.1.0)

org.springframework.security:spring-security-core MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - ai.authplane.sdk:authplane-spring =0.1.0, =1.0.0-beta.1,...