RHLW-2026-0A4E3CE968CB9794 Lightwell Security Advisory: spring-boot-autoconfigure 2.7.18.rhlw-00004

Red Hat Lightwell has released org.springframework.boot:spring-boot-autoconfigure 2.7.18.rhlw-00004 with a backported security fix. CVE-2026-41001: Predictable Temp Directory in Artemis Auto-configuration This patched artifact is a drop-in replacement for...

com.meltwater:rxrabbit (1.3.0), com.rabbitmq.jms:rabbitmq-jms (>=1.8.0, <=1.8.1) +6 more potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (4.3.0)

com.rabbitmq:amqp-client MAVEN version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.meltwater:rxrabbit 1.3.0 - com.rabbitmq.jms:rabbitmq-jms =1.8.0, =2.2.2, =2.2.2, =2.2.0, =2.2.0, =1.0.14,...

com.smoketurner.dropwizard:zipkin-core (>=1.3.8-1, <=1.3.9-1), io.dropwizard.metrics:metrics-graphite (4.1.0-rc3) +5 more potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (4.9.1)

com.rabbitmq:amqp-client MAVEN version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.smoketurner.dropwizard:zipkin-core =1.3.8-1, =2.0.0-rc0+test8, =2.11.9, =2.7.12, =2.7.12, =2.11.9, =2.12.0...

io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq (>=2.11.13, <=2.12.9), io.zipkin.reporter2:zipkin-reporter-spring-beans (>=2.7.15, <=2.8.2) +3 more potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (4.10.0)

com.rabbitmq:amqp-client MAVEN version 4.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq =2.11.13, =2.7.15, =2.7.15, =2.11.13, =2.12.9 -...

com.meltwater:rxrabbit (1.3.0), com.rabbitmq.jms:rabbitmq-jms (>=1.8.0, <=1.8.1) +6 more potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (4.3.0)

com.rabbitmq:amqp-client MAVEN version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.meltwater:rxrabbit 1.3.0 - com.rabbitmq.jms:rabbitmq-jms =1.8.0, =2.2.2, =2.2.2, =2.2.0, =2.2.0, =1.0.14,...

io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq (>=2.7.0, <=2.7.1), io.zipkin.java:zipkin-collector-rabbitmq (>=2.7.0, <=2.7.1) potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (4.5.0)

com.rabbitmq:amqp-client MAVEN version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq =2.7.0, =2.7.0, =2.7.1 Source cves: CVE-2026-106122 Sour...

com.smoketurner.dropwizard:zipkin-core (>=1.3.5-2, <=1.3.5-5), io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq (>=2.11.2, <=2.11.4) +3 more potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (4.7.0)

com.rabbitmq:amqp-client MAVEN version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.smoketurner.dropwizard:zipkin-core =1.3.5-2, =2.11.2, =2.7.7, =2.7.7, =2.11.2, =2.11.4 Source cves:...

com.smoketurner.dropwizard:zipkin-core (>=1.3.8-1, <=1.3.9-1), io.dropwizard.metrics:metrics-graphite (4.1.0-rc3) +5 more potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (4.9.1)

com.rabbitmq:amqp-client MAVEN version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.smoketurner.dropwizard:zipkin-core =1.3.8-1, =2.0.0-rc0+test8, =2.11.9, =2.7.12, =2.7.12, =2.11.9, =2.12.0...

io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq (>=2.11.13, <=2.12.9), io.zipkin.reporter2:zipkin-reporter-spring-beans (>=2.7.15, <=2.8.2) +3 more potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (4.10.0)

com.rabbitmq:amqp-client MAVEN version 4.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq =2.11.13, =2.7.15, =2.7.15, =2.11.13, =2.12.9 -...

io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq (>=2.11.13, <=2.12.9), io.zipkin.reporter2:zipkin-reporter-spring-beans (>=2.7.15, <=2.8.2) +3 more potentially affected by CVE-2026-106123 via com.rabbitmq:amqp-client (4.10.0)

com.rabbitmq:amqp-client MAVEN version 4.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq =2.11.13, =2.7.15, =2.7.15, =2.11.13, =2.12.9 -...

com.smoketurner.dropwizard:zipkin-core (>=1.3.5-2, <=1.3.5-5), io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq (>=2.11.2, <=2.11.4) +3 more potentially affected by CVE-2026-106123 via com.rabbitmq:amqp-client (4.7.0)

com.rabbitmq:amqp-client MAVEN version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.smoketurner.dropwizard:zipkin-core =1.3.5-2, =2.11.2, =2.7.7, =2.7.7, =2.11.2, =2.11.4 Source cves:...

io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq (>=2.4.6, <=2.6.1), io.zipkin.java:zipkin-collector-rabbitmq (>=2.4.6, <=2.6.1) potentially affected by CVE-2026-106123 via com.rabbitmq:amqp-client (4.4.2)

com.rabbitmq:amqp-client MAVEN version 4.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq =2.4.6, =2.4.6, =2.6.1 Source cves: CVE-2026-106123 Sour...

ai.chatur:cortex-core (>=0.0.1, <=0.1.4), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +2224 more potentially affected by CVE-2026-94651 via org.apache.thrift:libthrift (>=0.14.0, <=0.24.0)

org.apache.thrift:libthrift MAVEN version =0.14.0, =0.0.1, =0.0.1, =0.0.1, =3.10.0.5, =6.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =5.0.1, =1.2.0, =1.2.0, =2.0.0 - be.ugent.solidlab:shapeshift 0.0.1 and more Source cves: CVE-2026-94651 Source advisory: MEND:CVE-2026-94651...

K000163434: Spring Boot vulnerability CVE-2026-40976

Security Advisory Description In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on t...

ROOT-APP-MAVEN-CVE-2023-20883 CVE-2023-20883 in org.springframework.boot:spring-boot-autoconfigure - Patched by Root

Root has patched CVE-2023-20883 in the org.springframework.boot:spring-boot-autoconfigure package for Root:Maven. Multiple fixed versions available...

Security Bulletin: Vulnerability in Spring Boot affects DB2 Dev Extension (CVE-2026-40992, CVE-2026-41001)

Summary Upgraded spring-boot-autoconfigure to 3.5.15 to remediate CVE-2026-40992 Improper Certificate Validation and CVE-2026-41001 Insecure Temporary File — highest CVSS Base Score 5.3 Medium — PVR0789890. Vulnerability Details CVEID:CVE-2026-40992 DESCRIPTION: Spring Boot's Mail...

com.boxfuse.client:com.boxfuse.client.gradle.plugin (>=1.19.5.972, <=1.36.2.2021), com.ins.gradle.plugin.boxfuse:com.ins.gradle.plugin.boxfuse.gradle.plugin (1.0.1) +5 more potentially affected by CVE-2026-61700 via org.mariadb.jdbc:mariadb-java-client (1.4.5)

org.mariadb.jdbc:mariadb-java-client MAVEN version 1.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.mariadb.jdbc:mariadb-java-client and may be impacted: - com.boxfuse.client:com.boxfuse.client.gradle.plugin =1.19.5.972, =1.19.5.972, =1.1.0,...

io.zipkin.dependencies:zipkin-dependencies (1.11.2), io.zipkin.dependencies:zipkin-dependencies-mysql (1.11.2) +1 more potentially affected by CVE-2026-61700 via org.mariadb.jdbc:mariadb-java-client (1.7.1)

org.mariadb.jdbc:mariadb-java-client MAVEN version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.mariadb.jdbc:mariadb-java-client and may be impacted: - io.zipkin.dependencies:zipkin-dependencies 1.11.2 -...

io.zipkin.dependencies:zipkin-dependencies (>=1.7.0, <=1.10.3), io.zipkin.dependencies:zipkin-dependencies-mysql (>=1.7.0, <=1.10.3) +1 more potentially affected by CVE-2026-61700 via org.mariadb.jdbc:mariadb-java-client (1.6.3)

org.mariadb.jdbc:mariadb-java-client MAVEN version 1.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.mariadb.jdbc:mariadb-java-client and may be impacted: - io.zipkin.dependencies:zipkin-dependencies =1.7.0, =1.7.0, =1.29.4, =2.0.1 Source cves:...

io.zipkin.java:zipkin-autoconfigure-storage-mysql (>=0.21.0, <=1.0.0), us.fatehi:schemacrawler-mariadb (>=14.08.01, <=14.08.02) potentially affected by CVE-2026-61700 via org.mariadb.jdbc:mariadb-java-client (1.4.4)

org.mariadb.jdbc:mariadb-java-client MAVEN version 1.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.mariadb.jdbc:mariadb-java-client and may be impacted: - io.zipkin.java:zipkin-autoconfigure-storage-mysql =0.21.0, =14.08.01, =14.08.02 Source...