com.farao-community.farao:gridcapa-core-cc-data-bridge (>=1.3.0, <=1.6.0), com.farao-community.farao:gridcapa-data-bridge (>=2.4.0, <=2.7.0) potentially affected by CVE-2026-59274 via org.springframework.integration:spring-integration-zip (6.5.0)

org.springframework.integration:spring-integration-zip MAVEN version 6.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-zip and may be impacted: -...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the ZipTransformer process. An attacker can overwrite or plant files in arbitrary directories by pre-creating a symbolic link at /tmp/ziptransformer before the application starts, causing extracted archive contents an...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the UnZipTransformer process. An attacker can exhaust system memory and cause service outages by submitting specially crafted zip archives with excessive decompressed...

Cleartext Transmission of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information via the negotiation process. An attacker can intercept or alter files transferred and capture authentication credentials by performing a downgrade attack on the SMB protocol. Remediation...

cn.structured:structure-audit-application (v2.0.0), cn.structured:structure-audit-infra (v2.0.0) +103 more potentially affected by CVE-2026-59272 via org.springframework.amqp:spring-rabbit (>=4.0.0-m1, <=4.0.4)

org.springframework.amqp:spring-rabbit MAVEN version =4.0.0-m1, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-59272 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-19267969...

cn.hdfk7.boot:hdfk7-boot-starter-common (4.0.0), com.avides.spring:spring-rabbit (5.0.0-rc1) +102 more potentially affected by CVE-2026-59272 via org.springframework.amqp:spring-rabbit (4.1.0)

org.springframework.amqp:spring-rabbit MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-rabbit and may be impacted: - cn.hdfk7.boot:hdfk7-boot-starter-common 4.0.0 - com.avides.spring:spring-rabbit...

cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint

cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint...

br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0), br.com.sawcunhaos:scos-foundation-exception (>=1.0.0, <=1.1.0) +1096 more potentially affected by CVE-2026-59284 via org.springframework.cloud:spring-cloud-context (>=5.0.0-m1, <=5.0.2)

org.springframework.cloud:spring-cloud-context MAVEN version =5.0.0-m1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =5.0.0, =5.0.0, =5.0.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =8.0.0-alpha-springboot4, =8.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4,...

org.springframework.ai:spring-ai-starter-model-chat-memory-repository-redis (2.0.0) potentially affected by CVE-2026-59319 via org.springframework.ai:spring-ai-model-chat-memory-repository-redis (2.0.0)

org.springframework.ai:spring-ai-model-chat-memory-repository-redis MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.ai:spring-ai-model-chat-memory-repository-redis and may be impacted: -...

cn.hdfk7.boot:hdfk7-boot-starter-common (4.0.0), com.avides.spring:spring-rabbit (5.0.0-rc1) +106 more potentially affected by CVE-2026-47860 via org.springframework.amqp:spring-amqp (4.1.0)

org.springframework.amqp:spring-amqp MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - cn.hdfk7.boot:hdfk7-boot-starter-common 4.0.0 - com.avides.spring:spring-rabbit 5.0.0-r...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +22207 more potentially affected by CVE-2026-59313 via org.springframework:spring-webmvc (>=5.3.0, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =0.2.0, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo 0.1.0 - ai.apiprism:apiprism-spring-boot-starter 0.1.0 and more Source cves:...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +10009 more potentially affected by CVE-2026-47888 via org.springframework:spring-messaging (>=5.2.0.release, <=7.0.8)

org.springframework:spring-messaging MAVEN version =5.2.0.release, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.0.1, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.9.2 and more Source cves: CVE-2026-47888 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267440https://vulners.com/snyk...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +11893 more potentially affected by CVE-2026-47886 via org.springframework:spring-expression (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-expression MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.1.1-beta, =1.1.1-beta, =1.1.1-beta, =1.3.0-beta and more Source cves: CVE-2026-47886 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267073...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the SimpleEvaluationContext file when the SpEL expression compiler is enabled through specific configuration settings. An attacker can cause unbounded class-loading growth and bypa...

ai.astraform:remote-domain-conformance-java (0.2.0), ai.astraform:remote-domain-template-java-spring (0.2.0) +4021 more potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-47884 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267098...

ai.astraform:remote-domain-conformance-java (0.2.0), ai.astraform:remote-domain-template-java-spring (0.2.0) +4021 more potentially affected by CVE-2026-47887 via org.springframework:spring-webmvc (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-47887 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267099...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +12359 more potentially affected by CVE-2026-59282 via org.springframework:spring-beans (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-beans MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.1.1-beta, =1.1.1-beta, =1.1.1-beta, =1.3.0-beta and more Source cves: CVE-2026-59282 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267072...

HTTP Response Splitting

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to HTTP Response Splitting via the...

cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader

cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the evaluation of user-supplied SpEL expressions containing the power operator ^ with a BigDecimal or BigInteger operand and a large exponent value. An attacker can cause excessive...