com.erudika:para-server (>=1.52.0, <=1.54.7), io.orqueio.bpm.springboot:orqueio-bpm-spring-boot-starter-security (>=2.0.1, <=2.0.7) +3 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=7.0.0, <=7.0.5)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =7.0.0, =1.52.0, =2.0.1, =4.0.0, =4.0.0, =4.0.0, =4.0.6 Source cves: CVE-2026-41694 Source advisory: OSV:GHSA-WW38-37G9-M3Q3...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.3.0, <=11.8.5.ee), io.github.grails-spring-security-saml:spring-security-saml (>=6.0.9, <=6.0.10) +4 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.8.0, =11.3.0, =6.0.9, =1.19.1, =1.19.1, =5.26.4, =5.26.4, =5.27.15 Source cves: CVE-2026-41694 Source advisory: GHSA-WW38-37G9-M3Q3...

com.github.g-chenning:jdbc-yml-quick (0.0.6-release), io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.5.2, <=5.6.0) +3 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.11.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.github.g-chenning:jdbc-yml-quick 0.0.6-release -...

org.springframework.amqp:spring-rabbit (1.7.15.release), org.springframework.amqp:spring-rabbit-test (1.7.15.release) potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.15.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.7.15.release -...

Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

com.antheminc.oss:nimbus-core (>=1.1.7, <=1.2.0), com.antheminc.oss:nimbus-entity-dsl (>=1.1.7, <=1.2.0) +84 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.2.6.release)

org.springframework.security:spring-security-web MAVEN version 4.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.antheminc.oss:nimbus-core =1.1.7, =1.1.7, =1.1.7,...

br.jus.stf.digital:core (>=0.2.0, <=1.6.0), guru.springframework:page-view-client (0.0.2) +4 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.7.0.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - br.jus.stf.digital:core =0.2.0, =0.0.1, =1.5.0.release, =1.5.1.release Source...

br.jus.stf.digital:core (>=0.2.0, <=1.6.0), guru.springframework:page-view-client (0.0.2) +4 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.0.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - br.jus.stf.digital:core =0.2.0, =0.0.1, =1.5.0.release, =1.5.1.release Source...

com.github.g-chenning:jdbc-yml-quick (0.0.6-release), io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.5.2, <=5.6.0) +3 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.7.11.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.github.g-chenning:jdbc-yml-quick 0.0.6-release -...

io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.6.1, <=5.6.3), org.springframework.amqp:spring-rabbit (1.7.12.release) +2 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.12.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - io.zipkin.brave:brave-instrumentation-spring-rabbit =5.6.1, =5.6.3 -...

org.springframework.amqp:spring-rabbit (1.7.15.release), org.springframework.amqp:spring-rabbit-test (1.7.15.release) potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.7.15.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.7.15.release -...

org.springframework.security:spring-security-cas (4.2.14.release), org.springframework.security:spring-security-openid (4.2.14.release) +2 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.2.14.release)

org.springframework.security:spring-security-web MAVEN version 4.2.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.springframework.security:spring-security-cas...

com.sdl.delivery:udp-service-container-core (>=11.0.0-1078, <=11.0.1-1016), org.springframework.security:spring-security-cas (4.2.16.release) +3 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.2.16.release)

org.springframework.security:spring-security-web MAVEN version 4.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.sdl.delivery:udp-service-container-core...

com.github.shoothzj:sdk-distribute-impl-mongo (3.0.27.release), de.bwaldvogel:mongo-java-server-test-common (>=1.35.0, <=1.36.0) +3 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.2.10.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.shoothzj:sdk-distribute-impl-mongo 3.0.27.release -...

ACPM Multithreaded Minimal Transfer Stress Tester

This C program is a lightweight multi-threaded stress test designed to evaluate concurrent behavior of the acpmdoxfer interface under repeated small-size transfer operations across multiple threads sharing the same ACPM handle...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.9.0-alpha2) +7 more potentially affected by CVE-2026-40997 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40997 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320569...

CVE-2026-46481

OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TESTCONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in...

echelon8-test (0.0.1) potentially affected by CVE-2024-21485 via dash-html-components (0.10.1)

dash-html-components PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - echelon8-test 0.0.1 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...

echelon8-test (0.0.1) potentially affected by CVE-2024-21485 via dash-core-components (0.22.2)

dash-core-components PYPI version 0.22.2 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - echelon8-test 0.0.1 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-219...

CVE-2026-49842 FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test frames

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, modverto's WebSocket frame loop intercepts a -prefixed speed-test protocol SPU / SPB / SP...