ai.astraform:remote-domain-conformance-java (0.2.0), ai.astraform:remote-domain-template-java-spring (0.2.0) +3997 more potentially affected by CVE-2026-47890 via org.springframework:spring-webmvc (>=7.0.0, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =7.0.0, =0.1.0, =0.0.1, =0.0.1, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-47890 Source advisory: MEND:CVE-2026-47890...

ai.astraform:remote-domain-conformance-java (0.2.0), ai.astraform:remote-domain-template-java-spring (0.2.0) +3997 more potentially affected by CVE-2026-47887 via org.springframework:spring-webmvc (>=7.0.0, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =7.0.0, =0.1.0, =0.0.1, =0.0.1, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-47887 Source advisory: MEND:CVE-2026-47887...

ai.astraform:remote-domain-conformance-java (0.2.0), ai.astraform:remote-domain-template-java-spring (0.2.0) +3997 more potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (>=7.0.0, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =7.0.0, =0.1.0, =0.0.1, =0.0.1, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-47884 Source advisory: MEND:CVE-2026-47884...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through unbounded session retention in the handleInitRequest path of WebFluxStreamableServerTransportProvider and WebMvcStreamableServerTransportProvider. An unauthenticated remote...

CVE-2026-59279: Allocation of Resources Without Limits or Throttling

The MCP Streamable HTTP server transport WebFlux and WebMvc variants does not place any limit on the number of sessions it retains, and by default does not require clients to be authenticated. As a result, a remote attacker can cause the server to accumulate an unbounded number of sessions over...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.ancf.lmos:lmos-operator (>=0.5.0, <=0.6.0) +9572 more potentially affected by CVE-2026-47890 via org.springframework:spring-webmvc (>=6.2.0, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =6.2.0, =0.5.0, =0.1.2, =0.1.3, =0.1.0, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.29 and more Source cves: CVE-2026-47890 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267094...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +22146 more potentially affected by CVE-2026-59313 via org.springframework:spring-webmvc (>=5.3.0, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =0.2.0, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo 0.1.0 - ai.apiprism:apiprism-spring-boot-starter 0.1.0 and more Source cves:...

Cross-site Scripting (XSS)

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS when sending vi...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.ancf.lmos:lmos-operator (>=0.5.0, <=0.6.0) +9572 more potentially affected by CVE-2026-47883 via org.springframework:spring-webmvc (>=6.2.0, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =6.2.0, =0.5.0, =0.1.2, =0.1.3, =0.1.0, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.29 and more Source cves: CVE-2026-47883 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267433...

ai.astraform:remote-domain-conformance-java (0.2.0), ai.astraform:remote-domain-template-java-spring (0.2.0) +4006 more potentially affected by CVE-2026-47887 via org.springframework:spring-webmvc (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-47887 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267099...

ai.astraform:remote-domain-conformance-java (0.2.0), ai.astraform:remote-domain-template-java-spring (0.2.0) +4006 more potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-47884 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267098...

Arbitrary Code Injection

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Arbitrary Code Injection via the XsltVie...

Improper Neutralization

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Improper Neutralization in the...

Open Redirect

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Open Redirect in the UrlHandlerFilter...

eu.solven.adhoc:pivotable-js (0.1.0), eu.solven.adhoc:pivotable-server (0.1.0) +2 more potentially affected by CVE-2026-71438 via org.webjars.npm:mermaid (11.15.0)

org.webjars.npm:mermaid MAVEN version 11.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:mermaid and may be impacted: - eu.solven.adhoc:pivotable-js 0.1.0 - eu.solven.adhoc:pivotable-server 0.1.0 -...

eu.solven.adhoc:pivotable-js (0.1.0), eu.solven.adhoc:pivotable-server (0.1.0) +2 more potentially affected by CVE-2026-50159 via org.webjars.npm:mermaid (11.15.0)

org.webjars.npm:mermaid MAVEN version 11.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:mermaid and may be impacted: - eu.solven.adhoc:pivotable-js 0.1.0 - eu.solven.adhoc:pivotable-server 0.1.0 -...

eu.solven.adhoc:pivotable-js (0.1.0), eu.solven.adhoc:pivotable-server (0.1.0) +2 more potentially affected by CVE-2026-71436 via org.webjars.npm:mermaid (11.15.0)

org.webjars.npm:mermaid MAVEN version 11.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:mermaid and may be impacted: - eu.solven.adhoc:pivotable-js 0.1.0 - eu.solven.adhoc:pivotable-server 0.1.0 -...

DoS (Denial of Service) org.springframework:spring-webmvc Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 7.0.0, 7.1.0, and 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker t...

DoS (Denial of Service) org.springframework:spring-webmvc Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in spring-webmvc jar

Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846 reported for spring-webmvc-6.2.12.jar and spring-webmvc-6.2.18.jar. Vulnerability Details CVEID:CVE-2026-41841 DESCRIPTION: Spring MVC and...