org.springframework.integration:spring-integration-ftp (2.1.6.release), org.springframework.integration:spring-integration-sftp (2.1.6.release) potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (2.1.6.release)

org.springframework.integration:spring-integration-file MAVEN version 2.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

cn.herodotus.engine:message-sdk-mqtt (>=3.5.0.0, <=3.5.5.2), cn.herodotus.engine:message-spring-boot-starter (>=3.5.0.0, <=3.5.5.2) +24 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (>=6.5.0, <=6.5.8)

org.springframework.integration:spring-integration-file MAVEN version =6.5.0, =3.5.0.0, =3.5.0.0, =2.0.0-milestone-06, =2.0.0-milestone-06, =2.0.0-milestone-06, =2.0.0-milestone-06, =2.0.0-milestone-06, =11.47.0, =12.91.0 - org.springframework.cloud.fn:spring-aws-s3-common 5.2.0 -...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.webapp.modules:cloud-altemistafwk-webapp-jsf-conf (>=3.0.0.release, <=3.1.0.release) +733 more potentially affected by CVE-2026-40986 via org.springframework.webflow:spring-webflow (>=2.0.6.release, <=2.5.1.release)

org.springframework.webflow:spring-webflow MAVEN version =2.0.6.release, =3.0.0.release, =3.0.0.release, =2.0.0, =2.3.0, =2.1.0, =1.1.0, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =0.0.1, =5.1.3, =5.3.4 and more Source cves: CVE-2026-40986 Source advisory: GHSA-HW5C-XM3...

com.buession.cas:cas-server-support-captcha (4.0.0), com.buession.cas:cas-server-support-captcha-core (4.0.0) +449 more potentially affected by CVE-2026-40986 via org.springframework.webflow:spring-webflow (>=3.0.0, <=3.0.1)

org.springframework.webflow:spring-webflow MAVEN version =3.0.0, =6.2.0, =4.0.0-m0, =4.1.3 and more Source cves: CVE-2026-40986 Source advisory: GHSA-HW5C-XM3C-V96W...

com.buession.cas:cas-server-support-captcha (4.0.0), com.buession.cas:cas-server-support-captcha-core (4.0.0) +449 more potentially affected by CVE-2026-40986 via org.springframework.webflow:spring-webflow (>=3.0.0, <=3.0.1)

org.springframework.webflow:spring-webflow MAVEN version =3.0.0, =6.2.0, =4.0.0-m0, =4.1.3 and more Source cves: CVE-2026-40986 Source advisory: OSV:GHSA-HW5C-XM3C-V96W...

org.apereo.cas:cas-server-core (>=8.0.0-rc1, <=8.0.0-rc5), org.apereo.cas:cas-server-core-api (>=8.0.0-rc1, <=8.0.0-rc5) +342 more potentially affected by CVE-2026-40986 via org.springframework.webflow:spring-webflow (4.0.0)

org.springframework.webflow:spring-webflow MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.webflow:spring-webflow and may be impacted: - org.apereo.cas:cas-server-core =8.0.0-rc1, =8.0.0-rc1, =8.0.0-rc1,...

org.springframework.integration:spring-integration-ftp (4.2.12.release), org.springframework.integration:spring-integration-sftp (4.2.12.release) potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.2.12.release)

org.springframework.integration:spring-integration-file MAVEN version 4.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker...

org.springframework.integration:spring-integration-ftp (4.3.24.release), org.springframework.integration:spring-integration-sftp (4.3.24.release) +1 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.24.release)

org.springframework.integration:spring-integration-file MAVEN version 4.3.24.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

org.springframework.integration:spring-integration-ftp (2.2.6.release), org.springframework.integration:spring-integration-sftp (2.2.6.release) potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (2.2.6.release)

org.springframework.integration:spring-integration-file MAVEN version 2.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

org.springframework.integration:spring-integration-ftp (2.1.5.release), org.springframework.integration:spring-integration-sftp (2.1.5.release) potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (2.1.5.release)

org.springframework.integration:spring-integration-file MAVEN version 2.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

org.springframework.boot:spring-boot-starter-integration (1.3.0.release), org.springframework.integration:spring-integration-ftp (4.2.1.release) +1 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.2.1.release)

org.springframework.integration:spring-integration-file MAVEN version 4.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

com.ahome-it:ahome-tooling-server-core (>=1.0.110-release, <=1.0.121-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.111-release, <=1.0.121-release) +7 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.2.0.release)

org.springframework.integration:spring-integration-file MAVEN version 4.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.ahome-it:ahome-tooling-server-core...

org.springframework.integration:spring-integration-ftp (2.0.6.release), org.springframework.integration:spring-integration-sftp (2.0.6.release) potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (2.0.6.release)

org.springframework.integration:spring-integration-file MAVEN version 2.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

org.springframework.integration:spring-integration-ftp (4.2.7.release), org.springframework.integration:spring-integration-sftp (4.2.7.release) potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.2.7.release)

org.springframework.integration:spring-integration-file MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

GHSA-HW5C-XM3C-V96W Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker...

org.springframework.cloud:spring-cloud-dataflow-server-local (>=1.5.0.release, <=1.5.2.release), org.springframework.integration:spring-integration-ftp (4.3.16.release) +1 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.16.release)

org.springframework.integration:spring-integration-file MAVEN version 4.3.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

org.springframework.boot:spring-boot-starter-integration (>=1.1.7.release, <=1.1.9.release), org.springframework.integration:spring-integration-ftp (4.0.4.release) +1 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.0.4.release)

org.springframework.integration:spring-integration-file MAVEN version 4.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

org.springframework.boot:spring-boot-starter-integration (>=1.3.7.release, <=1.3.8.release), org.springframework.cloud.stream.app:file-sink-kafka (1.0.2.release) +23 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.2.9.release)

org.springframework.integration:spring-integration-file MAVEN version 4.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

ai.intelliswarm:swarmai-eval (>=1.0.0, <=1.0.29), ai.intelliswarm:swarmai-rag (>=1.0.28, <=1.0.29) +472 more potentially affected by CVE-2026-40992 via org.springframework.boot:spring-boot-starter-mail (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot-starter-mail MAVEN version =3.4.0, =1.0.0, =1.0.28, =1.0.0, =3.2.5, =5.0.0-beta.4, =1.0.0, =1.0.1-jdk21, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.5 and more Source cves: CVE-2026-40992 Source advisory: GHSA-9WXP-W4PX-32VH...