org.apache.mina:mina-example (1.0.4), org.apache.mina:mina-filter-compression (1.0.4) +4 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.0.4)

org.apache.mina:mina-core MAVEN version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.0.4 - org.apache.mina:mina-filter-compression 1.0.4 -...

Important: Red Hat Security Advisory: Red Hat Data Grid 8.6.1 security update

An update for Red Hat Data Grid 8 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure.

A flaw was found in Spring Boot. The $random.value property source utilizes a weak pseudo-random number generator PRNG, meaning the values it produces are not sufficiently random for use as cryptographic secrets. An attacker could potentially predict these values, which may lead to information...

Security Bulletin: Due to use of spring-webmvc-6.2.17.jar, IBM Sterling Connect:Direct Web Services is vulnerable to cache poisoning when resolving static resources.

Summary spring-webmvc-6.2.17.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-22741. Vulnerability Details CVEID:CVE-2026-22741 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be...

ai.apiverse:apipulse (1.0.1), be.personify.iam:personify-api (>=1.5.0.release, <=1.5.8.release) +475 more potentially affected by CVE-2026-41007 via org.springframework.hateoas:spring-hateoas (>=1.5.0, <=2.5.2)

org.springframework.hateoas:spring-hateoas MAVEN version =1.5.0, =1.5.0.release, =1.5.1.release, =1.5.0.release, =2.1.0.release, =1.0.1, =1.0.1, =1.0.1, =2.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =2.1.21 and more Source cves: CVE-2026-41007 Source advisory:...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +44 more potentially affected by CVE-2026-41007 via org.springframework.hateoas:spring-hateoas (>=3.0.0-m1, <=3.0.3)

org.springframework.hateoas:spring-hateoas MAVEN version =3.0.0-m1, =0.0.1-beta, =3.0.0, =3.0.0, =1.0.0, =4.0, =4.0, =3.0.9, =3.0.9, =3.0.9, =3.0.0, =1.0.45, =1.0.81 and more Source cves: CVE-2026-41007 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKHATEOAS-17255295https://vu...

MilvusVectorStore doDelete Method

The vulnerability of the MilvusVectorStoredoDeleteList method in the Spring AI framework for model development involves the failure to take measures to neutralize special elements used in the expression language operator. Exploiting this vulnerability can allow an attacker to compromise the...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via reflective property binding in PropertyUtils.createObjectFromProperties. An attacker can modify security-sensitive object properties by supplying crafted...

ai.apiverse:apipulse (1.0.1), be.personify.iam:personify-api (>=1.5.0.release, <=1.5.8.release) +475 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (>=1.5.0, <=2.5.2)

org.springframework.hateoas:spring-hateoas MAVEN version =1.5.0, =1.5.0.release, =1.5.1.release, =1.5.0.release, =2.1.0.release, =1.0.1, =1.0.1, =1.0.1, =2.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =2.1.21 and more Source cves: CVE-2026-41006 Source advisory:...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded caching of StringLinkRelation instances. An attacker can cause denial of service by supplying a large number of unique link relation values, causing the static cache to...

CicadasCMS code injection vulnerability

CicadasCMS is a content management framework developed by the Chinese individual developer westboy, based on SpringBoot, Mybatis, SpringSecurity, and Vue. CicadasCMS has a code injection vulnerability, which stems from an unknown function issue in the task scheduling management module, specifical...

cn.herodotus.engine:event-message-spring-boot-starter (>=2.7.11.1, <=2.7.18.final), com.azure.spring:spring-cloud-azure-starter-stream-eventhubs (>=4.8.0, <=4.20.0) +113 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=3.2.10, <=3.2.12)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.10, =2.7.11.1, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 - com.findevglobal:spring-cloud-stream-binder-amps 1.0.0 - com.findevglobal:spring-cloud-stream-tracer-a...

cn.herodotus.engine:event-message-spring-boot-starter (>=2.7.11.1, <=2.7.18.final), com.azure.spring:spring-cloud-azure-starter-stream-eventhubs (>=4.8.0, <=4.20.0) +113 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=3.2.10, <=3.2.12)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.10, =2.7.11.1, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 - com.findevglobal:spring-cloud-stream-binder-amps 1.0.0 - com.findevglobal:spring-cloud-stream-tracer-a...

ch.sbb:spring-cloud-stream-binder-solace (>=4.0.0, <=5.0.3), city.hiperium:cities-functions-parent-pom (>=1.0.0, <=1.0.5) +640 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=4.1.0, <=4.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.1.0, =4.0.0, =1.0.0, =1.0.1, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =2023.0.3.4 and more Source cves: CVE-2026-40990...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.39.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=6.0.0, <=7.4.5) +184 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.3.0, =17.39.0, =6.0.0, =2025.0.0.0, =2025.0.0.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =0.2.0, =0.2.1 - com.github.ggreen:split-json-array-processor 0.0.1 and more Source cves: CVE-2026-40990 Source advisory:...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.structured:structure-app-application (>=v2.0.0, <=2.0.1) +205 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=5.0.0, <=5.0.1)

org.springframework.cloud:spring-cloud-function-context MAVEN version =5.0.0, =8.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 - cn.structured:structure-audit-interfaces v2.0.0 -...

ch.sbb:spring-cloud-stream-binder-solace (>=4.0.0, <=5.0.3), city.hiperium:cities-functions-parent-pom (>=1.0.0, <=1.0.5) +640 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.1.0, <=4.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.1.0, =4.0.0, =1.0.0, =1.0.1, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =2023.0.3.4 and more Source cves: CVE-2026-40989...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=17.38.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=5.2.0) +357 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.2.0, =17.16.0, =5.0.5, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =1.16.0,...

GHSA-X9C7-5H6G-HQ8Q Spring Cloud Function Context has Uncontrolled Recursion

Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud...

ch.sbb:spring-cloud-stream-binder-solace (>=4.0.0, <=5.0.3), city.hiperium:cities-functions-parent-pom (>=1.0.0, <=1.0.5) +640 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.1.0, <=4.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.1.0, =4.0.0, =1.0.0, =1.0.1, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =2023.0.3.4 and more Source cves: CVE-2026-40989...