ai.apiverse:apipulse (1.0.1), ai.chat2db.excel:easyexcel-plus-test (0.0.1) +13604 more potentially affected by CVE-2026-40974 via org.springframework.boot:spring-boot-autoconfigure (>=2.7.0, <=2.7.18)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =2.7.0, =0.18, =0.18, =0.18, =0.18, =0.18, =0.18, =0.18, =1.0, =0.8.38, =0.8.38, =v0.16.1, =v0.16.1, =v0.16.1, =v0.123.652 and more Source cves: CVE-2026-40974 Source advisory: MEND:CVE-2026-40974...

PT-2026-35548

Name of the Vulnerable Software and Affected Versions Spring Boot versions 4.0.0 through 4.0.5 Description Default web security in certain configurations is ineffective, allowing unauthorized and unauthenticated access to all endpoints. This occurs when a servlet-based web application relies on t...

Insufficiently Protected Credentials

Overview org.springframework.ai:spring-ai-autoconfigure-model-transformers is a Spring AI ONNX Transformers Auto Configuration Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the default cache directory used by TransformersEmbeddingModel. An attacker c...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +24441 more potentially affected by CVE-2026-40974 via org.springframework.boot:spring-boot-autoconfigure (>=3.0.0, <=3.5.13)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.0.0, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 - ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo 0.1.0 -...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch due to establishing SSL connections to Cassandra without verifying that the hostname in the server's SSL certificate actually matched the hostname of the server being connected to...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch when using an SSL bundle. This effectively weakens TLS by allowing connections without verifying the server identity classic MITM risk. Remediation Upgrade...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the configuration of endpoints under paths already assigned to Health Group additional paths. An attacker can gain unauthorized access to protected endpoints by sending reques...

ai.ancf.lmos:arc-runner (>=0.1.1, <=0.114.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +5019 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=3.0.0, <=3.5.11)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =3.0.0, =0.1.1, =0.0.4, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =cloud-0.1, =0.6 - ai.ylyue:yue-library-base j17.3.3.1 - ai.ylyue:yue-library-base-crypto j17.3.3.1 and more Source...

Modularizing Spring Boot

Continuing our Road to GA series, this week we're exploring the modularization effort happening with Spring Boot 4. When Spring Boot 1.0 was released in 2014, it shipped with a single spring-boot-autoconfigure jar weighing in at 182 KiB. Of course, that initial version didn't support a great deal...

cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure (1.0.2), cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure-amqp (1.0.2) +266 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.5.21.release)

org.springframework.boot:spring-boot MAVEN version 1.5.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure 1.0.2 -...

ai.ancf.lmos:arc-runner (>=0.1.1, <=0.114.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +4250 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=3.0.0, <=3.4.4)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =3.0.0, =0.1.1, =0.0.4, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =cloud-0.1, =0.6 - ai.ylyue:yue-library-base j17.3.3.1 - ai.ylyue:yue-library-base-crypto j17.3.3.1 and more Source...

ai.ancf.lmos:arc-runner (>=0.1.1, <=0.112.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.4.0) +5205 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=2.7.0, <=3.3.10)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =2.7.0, =0.1.1, =0.0.4, =0.1.0, =cloud-0.1, =6.4.0, =1.1.0, =2.3.0, =1.1.0, =1.1.0, =2.10.0, =1.1.0, =1.1.0, =2.3.0, =1.1.0, =1.2.0 and more Source cves: CVE-2025-22235 Sou...

com.kakawait:cas-security-dynamic-service-resolver (>=0.1.0, <=0.4.0), com.kakawait:cas-security-spring-boot-autoconfigure (>=0.1.0, <=0.3.2) +9 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-cas (>=4.2.2.release, <=4.2.14.release)

org.springframework.security:spring-security-cas MAVEN version =4.2.2.release, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =9.4.0.10, =2.3.0, =2.3.0, =5.20.2, =5.21.1, =5.22.7 Source cves: CVE-2024-38827 Source advisory: MEND:CVE-2024-38827...

com.graphql-java:graphql-java-servlet (>=4.6.0, <=4.7.0), com.graphql-java:graphql-java-tools (>=4.2.0, <=4.3.0) +21 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (6.0)

com.graphql-java:graphql-java MAVEN version 6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.graphql-java:graphql-java-servlet =4.6.0, =4.2.0, =3.10.0, =3.10.0, =0.3.1, =0.3.1, =0.3.1, =1.5.7,...

com.graphql-java:graphql-java-servlet (>=5.0.0, <=5.0.1), com.graphql-java:graphql-java-tools (>=5.0.0, <=5.2.3) +51 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (8.0)

com.graphql-java:graphql-java MAVEN version 8.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.graphql-java:graphql-java-servlet =5.0.0, =5.0.0, =4.1.0, =4.1.0, =1.5.18, =1.5.18, =1.5.13, =1.5.1...

com.graphql-java:graphql-java-servlet (>=4.4.0, <=4.5.0), com.graphql-java:graphql-java-tools (>=4.1.1, <=4.1.2) +9 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (4.2)

com.graphql-java:graphql-java MAVEN version 4.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.graphql-java:graphql-java-servlet =4.4.0, =4.1.1, =3.9.0, =3.9.0, =1.5.0, =1.1.6-2017-09-24t06-21-2...

VuFind Server-Side Request Forgery (SSRF) vulnerability

A Server-Side Request Forgery SSRF vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0 through 9.1 before 9.1.1 allows a remote attacker to overwrite local configuration files to gain access to the administrator panel and achieve Remote Code Execution. A mitigating...

CVE-2024-25738

A Server-Side Request Forgery SSRF vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0 through 9.1 before 9.1.1 allows a remote attacker to overwrite local configuration files to gain access to the administrator panel and achieve Remote Code Execution. A mitigating...

CVE-2024-25738

Open Library Foundation VuFind versions 2.0 through 9.1 before 9.1.1 are vulnerable to a Server-Side Request Forgery (SSRF) in the /Upgrade/FixConfig route. An attacker can exploit this to overwrite local configuration files, potentially gaining access to the administrator panel and achieving Rem...

spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry

A flaw was found in Spring Boot. This targets specifically 'spring-boot-actuator-autoconfigure' package. This issue occurs when an application is deployed to Cloud Foundry, which could be susceptible to a security bypass. Specifically, an application is vulnerable when all of the following are...