ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +47 more potentially affected by CVE-2026-41863 via org.springframework.ai:spring-ai-anthropic (>=1.1.0, <=1.1.6)

org.springframework.ai:spring-ai-anthropic MAVEN version =1.1.0, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.6.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =0.4.0 and more Source cves: CVE-2026-41863 Source advisory: GHSA-CC4M-MP48-X7QG...

GHSA-CC4M-MP48-X7QG Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk

Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories. Affected versions: Spring AI: 1.1.0...

biz.devstack.springframework.boot:spring-boot-starter-api (>=1.0.0, <=1.2.1), biz.devstack:spring-boot-starter-api-quickstart (>=1.0.0, <=1.0.4) +865 more potentially affected by CVE-2026-9370 via com.github.ulisesbocchio:jasypt-spring-boot-starter (>=3.0.0, <=4.0.4)

com.github.ulisesbocchio:jasypt-spring-boot-starter MAVEN version =3.0.0, =1.0.0, =1.0.0, =1.0, =1.0.4.r, =4.0.6.117.0, =4.0.6.117.1, =1.1.1, =1.0.1, =1.0.7 - club.gclmit:chaos-spring-boot-starter 1.5.0.release - cn.com.tltim.pigx:mybatis-enhance 5.0.0-20240820 - cn.com.tltim.pigx:pigx...

biz.devstack.springframework.boot:spring-boot-starter-api (>=1.0.0, <=1.2.1), biz.devstack:spring-boot-starter-api-quickstart (>=1.0.0, <=1.0.4) +916 more potentially affected by CVE-2026-9370 via com.github.ulisesbocchio:jasypt-spring-boot (>=3.0.0, <=4.0.4)

com.github.ulisesbocchio:jasypt-spring-boot MAVEN version =3.0.0, =1.0.0, =1.0.0, =1.0, =1.0.4.r, =4.0.6.117.0, =4.0.6.117.1, =1.1.1, =1.0.1, =1.0.7 - club.gclmit:chaos-spring-boot-starter 1.5.0.release - cn.com.tltim.pigx:mybatis-enhance 5.0.0-20240820 - cn.com.tltim.pigx:pigx 5.0.0-20240820 -...

jasypt-spring-boot Uses a One-Way Hash without a Salt

A weakness has been identified in ulisesbocchio jasypt-spring-boot up to 3.0.5/4.0.4. Affected by this vulnerability is the function getSecretKeySaltGenerator of the file jasypt-spring-boot/src/main/java/com/ulisesbocchio/jasyptspringboot/encryptor/SimpleGCMConfig.java of the component Password...

GHSA-JGJ7-C8VJ-W563 jasypt-spring-boot Uses a One-Way Hash without a Salt

A weakness has been identified in ulisesbocchio jasypt-spring-boot up to 3.0.5/4.0.4. Affected by this vulnerability is the function getSecretKeySaltGenerator of the file jasypt-spring-boot/src/main/java/com/ulisesbocchio/jasyptspringboot/encryptor/SimpleGCMConfig.java of the component Password...

biz.devstack.springframework.boot:spring-boot-starter-api (>=1.0.0, <=1.2.1), biz.devstack:spring-boot-starter-api-quickstart (>=1.0.0, <=1.0.4) +865 more potentially affected by CVE-2026-9370 via com.github.ulisesbocchio:jasypt-spring-boot-starter (>=3.0.0, <=4.0.4)

com.github.ulisesbocchio:jasypt-spring-boot-starter MAVEN version =3.0.0, =1.0.0, =1.0.0, =1.0, =1.0.4.r, =4.0.6.117.0, =4.0.6.117.1, =1.1.1, =1.0.1, =1.0.7 - club.gclmit:chaos-spring-boot-starter 1.5.0.release - cn.com.tltim.pigx:mybatis-enhance 5.0.0-20240820 - cn.com.tltim.pigx:pigx...

biz.devstack.springframework.boot:spring-boot-starter-api (>=1.0.0, <=1.2.1), biz.devstack:spring-boot-starter-api-quickstart (>=1.0.0, <=1.0.4) +916 more potentially affected by CVE-2026-9370 via com.github.ulisesbocchio:jasypt-spring-boot (>=3.0.0, <=4.0.4)

com.github.ulisesbocchio:jasypt-spring-boot MAVEN version =3.0.0, =1.0.0, =1.0.0, =1.0, =1.0.4.r, =4.0.6.117.0, =4.0.6.117.1, =1.1.1, =1.0.1, =1.0.7 - club.gclmit:chaos-spring-boot-starter 1.5.0.release - cn.com.tltim.pigx:mybatis-enhance 5.0.0-20240820 - cn.com.tltim.pigx:pigx 5.0.0-20240820 -...

com.github.vindell:spring-boot-starter-cxf-jaxws-plus (>=1.0.0.release, <=1.0.2.release), org.apache.cxf:apache-cxf (>=3.3.0, <=3.6.10) +1 more potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=3.2.4, <=3.6.10)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =3.2.4, =1.0.0.release, =3.3.0, =3.4.0, =3.6.10 Source cves: CVE-2026-44618 Source advisory: GHSA-VMM5-FJGX-2JHP...

com.github.vindell:spring-boot-starter-cxf-jaxws-plus (>=1.0.0.release, <=1.0.2.release), org.apache.cxf:apache-cxf (>=3.3.0, <=3.6.10) +1 more potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=3.2.4, <=3.6.10)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =3.2.4, =1.0.0.release, =3.3.0, =3.4.0, =3.6.10 Source cves: CVE-2026-44618 Source advisory: OSV:GHSA-VMM5-FJGX-2JHP...

This Week in Spring - May 26th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in Coimbra, Portugal, where I just did my usual shtick on the latest and greatest in Spring Framework 7.x, Spring Boot 4.x, and Spring AI 2.x. It was a ton of fun, and I want to thank everybody who came out. Last week I w...

com.buession.security:buession-security-shiro (4.0.0), com.ctakit:ctakit-web (>=1.0.2, <=1.0.5) +61 more potentially affected by CVE-2026-43828 via org.apache.shiro:shiro-spring (>=2.0.0, <=2.1.0)

org.apache.shiro:shiro-spring MAVEN version =2.0.0, =1.0.2, =3.4.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =4.1.0, =1.3.0.2.5, =4.0.39, =4.0.39, =4.6.78 and more Source cves: CVE-2026-43828 Source advisory: MEND:CVE-2026-43828...

com.nb6868.onex:common (5.0.3), com.nb6868.onex:file-converter (5.0.3) +10 more potentially affected by CVE-2026-43828 via org.apache.shiro:shiro-spring (3.0.0-alpha-1)

org.apache.shiro:shiro-spring MAVEN version 3.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-spring and may be impacted: - com.nb6868.onex:common 5.0.3 - com.nb6868.onex:file-converter 5.0.3 - com.nb6868.onex:job 5.0...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m1, <=4.0.5), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m1, <=4.0.5) +38 more potentially affected by CVE-2026-42782 via org.apache.syncope.core:syncope-core-spring (>=3.0.0-m1, <=4.0.5)

org.apache.syncope.core:syncope-core-spring MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.2, =4.0.0-m0, =3.0.0-m1, =3.0.0-m1, =4.0.0-m0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.5 and more Source cves: CVE-2026-42782https://vulners.com/cve...

org.apache.syncope.core.am:syncope-core-am-logic (4.1.0), org.apache.syncope.core.am:syncope-core-am-rest-cxf (4.1.0) +33 more potentially affected by CVE-2026-42782 via org.apache.syncope.core:syncope-core-spring (4.1.0)

org.apache.syncope.core:syncope-core-spring MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope.core:syncope-core-spring and may be impacted: - org.apache.syncope.core.am:syncope-core-am-logic 4.1.0 -...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.0-m0, <=4.0.5), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.0-m0, <=4.0.5) +33 more potentially affected by CVE-2026-42782 via org.apache.syncope.core:syncope-core-spring (>=4.0.0-m0, <=4.0.5)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.2, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.5 and more Source cves: CVE-2026-42782https://vulne...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.0), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.0) +33 more potentially affected by CVE-2026-42782 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.0)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0 and more Source cves: CVE-2026-42782https://vu...

CVE-2026-41863

Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories. Affected versions: Spring AI: 1.1.0...

CVE-2026-41863 LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API

Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories. Affected versions: Spring AI: 1.1.0...

CVE-2026-41863

Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories. Affected versions: Spring AI: 1.1.0...