ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=9.3.0) +558 more potentially affected by CVE-2026-59291 via org.springframework.cloud:spring-cloud-function-context (>=4.2.0, <=5.0.3)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.2.0, =17.16.0, =5.0.5, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =3.5.5.2 and more Source cves: CVE-2026-59291https...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.3.0), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.1.0.1) +275 more potentially affected by CVE-2026-59299 via org.springframework.cloud:spring-cloud-function-context (>=5.0.0-m1, <=5.0.3)

org.springframework.cloud:spring-cloud-function-context MAVEN version =5.0.0-m1, =8.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =1.0.0, =1.0.0, =1.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 and more Source cves: CVE-2026-59299 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267413...

be.appify.prefab:prefab-security (>=0.11.0, <=0.12.0), build.jenesis:build.jenesis.repository.bundle (>=0.1.0, <=0.7.0) +426 more potentially affected by CVE-2026-41707 via org.springframework.security:spring-security-oauth2-jose (7.1.0)

org.springframework.security:spring-security-oauth2-jose MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-jose and may be impacted: - be.appify.prefab:prefab-security =0.11.0, =0.1....

ai.mindconnect:mc-agent-admin-ui-app (>=0.0.2, <=0.8.4), ai.mindconnect:mc-agent-admin-ui-rest (>=0.0.2, <=0.8.4) +1191 more potentially affected by CVE-2026-41707 via org.springframework.security:spring-security-oauth2-jose (>=6.5.0, <=7.0.6)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.5.0, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =1.0.0.ee-20260424025040, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =1.24.0, =1.24.0, =6.3.0 and more Source cves: CVE-2026-41707 Source advisory:...

com.github.piomin:spring-cloud-schema-registry-client-apicurio (>=1.4.0, <=2.0.0) potentially affected by CVE-2026-59304 via org.springframework.cloud:spring-cloud-stream-schema-registry-client (>=4.3.1, <=5.0.0)

org.springframework.cloud:spring-cloud-stream-schema-registry-client MAVEN version =4.3.1, =1.4.0, =2.0.0 Source cves: CVE-2026-59304 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267415...

com.farao-community.farao:gridcapa-core-cc-data-bridge (>=1.3.0, <=1.6.0), com.farao-community.farao:gridcapa-data-bridge (>=2.4.0, <=2.7.0) potentially affected by CVE-2026-59311 via org.springframework.integration:spring-integration-zip (6.5.0)

org.springframework.integration:spring-integration-zip MAVEN version 6.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-zip and may be impacted: -...

com.farao-community.farao:gridcapa-core-cc-data-bridge (>=1.3.0, <=1.6.0), com.farao-community.farao:gridcapa-data-bridge (>=2.4.0, <=2.7.0) potentially affected by CVE-2026-47862 via org.springframework.integration:spring-integration-zip (6.5.0)

org.springframework.integration:spring-integration-zip MAVEN version 6.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-zip and may be impacted: -...

com.farao-community.farao:gridcapa-core-cc-data-bridge (>=1.3.0, <=1.6.0), com.farao-community.farao:gridcapa-data-bridge (>=2.4.0, <=2.7.0) potentially affected by CVE-2026-59274 via org.springframework.integration:spring-integration-zip (6.5.0)

org.springframework.integration:spring-integration-zip MAVEN version 6.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-zip and may be impacted: -...

cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint

cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the ZipTransformer process. An attacker can overwrite or plant files in arbitrary directories by pre-creating a symbolic link at /tmp/ziptransformer before the application starts, causing extracted archive contents an...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the UnZipTransformer process. An attacker can exhaust system memory and cause service outages by submitting specially crafted zip archives with excessive decompressed...

Cleartext Transmission of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information via the negotiation process. An attacker can intercept or alter files transferred and capture authentication credentials by performing a downgrade attack on the SMB protocol. Remediation...

org.springframework.ai:spring-ai-starter-model-chat-memory-repository-redis (2.0.0) potentially affected by CVE-2026-59319 via org.springframework.ai:spring-ai-model-chat-memory-repository-redis (2.0.0)

org.springframework.ai:spring-ai-model-chat-memory-repository-redis MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.ai:spring-ai-model-chat-memory-repository-redis and may be impacted: -...

cn.hdfk7.boot:hdfk7-boot-starter-common (4.0.0), com.avides.spring:spring-rabbit (5.0.0-rc1) +106 more potentially affected by CVE-2026-47860 via org.springframework.amqp:spring-amqp (4.1.0)

org.springframework.amqp:spring-amqp MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - cn.hdfk7.boot:hdfk7-boot-starter-common 4.0.0 - com.avides.spring:spring-rabbit 5.0.0-r...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the SimpleEvaluationContext file when the SpEL expression compiler is enabled through specific configuration settings. An attacker can cause unbounded class-loading growth and bypa...

Missing Release of Resource after Effective Lifetime

Overview org.springframework:spring-messaging is a framework and inversion of control container for the Java platform. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the RSocketMessageHandler process when handling a malformed SETUP...

cve-2026-47893 - LOW - Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService

cve-2026-47893 - LOW - Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService...

ai.astraform:remote-domain-conformance-java (0.2.0), ai.astraform:remote-domain-template-java-spring (0.2.0) +4021 more potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-47884 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267098...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +11893 more potentially affected by CVE-2026-47886 via org.springframework:spring-expression (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-expression MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.1.1-beta, =1.1.1-beta, =1.1.1-beta, =1.3.0-beta and more Source cves: CVE-2026-47886 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267073...

ai.astraform:remote-domain-conformance-java (0.2.0), ai.astraform:remote-domain-template-java-spring (0.2.0) +4021 more potentially affected by CVE-2026-47887 via org.springframework:spring-webmvc (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-47887 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267099...