biz.jovido:jovido-webseed (>=0.0.1, <=0.0.1-fenicesfa), biz.jovido:jovido-webseed-fenicesfa (0.0.1) +691 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.4.release)

org.springframework.boot:spring-boot MAVEN version 1.5.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - biz.jovido:jovido-webseed =0.0.1, =1.0, =1.0, =1.0, =1.0.1, =1.0.0, =a.1.0.0,...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (0.28.0) +8589 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.3.0, <=3.3.13)

org.springframework.boot:spring-boot MAVEN version =3.3.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-40973 Source advisory: OSV:GHSA-WWPQ-F5C3-7HVX...

GHSA-WWPQ-F5C3-7HVX Spring Boot accepts predictable temp directory without ownership verification

A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack...

co.fingerprintsoft:notification-spring-boot-autoconfigure (1.0.9), co.fingerprintsoft:notification-spring-boot-starter (1.0.9) +222 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.3.7.release)

org.springframework.boot:spring-boot MAVEN version 1.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - co.fingerprintsoft:notification-spring-boot-autoconfigure 1.0.9 -...

com.github.jlgrock.snp:client (0.1), com.github.jlgrock.snp:core (0.1) +78 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.2.0.release)

org.springframework.boot:spring-boot MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.github.jlgrock.snp:client 0.1 - com.github.jlgrock.snp:core 0.1 -...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10513 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.5.0, <=3.5.13)

org.springframework.boot:spring-boot MAVEN version =3.5.0, =0.1.0, =0.1.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.6.0, =0.0.2, =0.8.4 and more Source cves: CVE-2026-40973 Source advisory: OSV:GHSA-WWPQ-F5C3-7HVX...

Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification

Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15 fix 3.4.16, 3.3.0–3.3.18 fix 3.3.19, 2.7.0–2.7.32 fix 2.7.33; Cassandra SSL...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.114.0, <=0.120.0) +9122 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot MAVEN version =3.4.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.29 and more Source cves: CVE-2026-40973 Source advisory: OSV:GHSA-WWPQ-F5C3-7HVX...

com.definesys.mpaas:query-weblogic (1.0.0), io.github.sethdeveloper:fixed-asset-engine (>=0.1.4-jdk8-m2, <=0.2.3-monthly-daily-depre-jdk8) +30 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.1.12.release)

org.springframework.boot:spring-boot MAVEN version 1.1.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.definesys.mpaas:query-weblogic 1.0.0 -...

ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.4-sb1x, <=0.1.4-sb1x_6) +324 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.3.0.release)

org.springframework.boot:spring-boot MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter =0.1.6,...

cn.afterturn:easypoi-spring-boot-starter (>=0.1, <=0.1.1), cn.dubby:dubby_blog (>=1.2, <=1.4) +1503 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.8.release)

org.springframework.boot:spring-boot MAVEN version 1.5.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cn.afterturn:easypoi-spring-boot-starter =0.1, =1.2, =1.1, =1.1, =1.1, =1.0.0,...

ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0, <=0.3.0) +5498 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot MAVEN version =4.0.0, =0.1.0, =0.1.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.7.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-2, =2.0.0 and more Source cves: CVE-2026-40973 Source advisory: OSV:GHSA-WWPQ-F5C3-7HVX...

com.blitline:blitline-image-client-example (>=0.14.0, <=0.14.3), com.erudika:para (>=1.9.0, <=1.11) +44 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.1.8.release)

org.springframework.boot:spring-boot MAVEN version 1.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.blitline:blitline-image-client-example =0.14.0, =1.9.0, =1.1.5, =1.1.5,...

Spring Boot's random value property source uses a weak PRNG unsuitable for secrets

Values produced by $random.value are not suitable for use as secrets. $random.uuid is not affected. $random.int and $random.long should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15...

com.github.microwww:mocker-redis-spring-boot-autoconfigure (>=0.0.1, <=3.0.0), com.github.microwww:mocker-redis-spring-boot-starter (>=0.0.1, <=3.0.2-2.8) +79 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.0.release)

org.springframework.boot:spring-boot MAVEN version 1.5.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.github.microwww:mocker-redis-spring-boot-autoconfigure =0.0.1, =0.0.1,...

com.gitee.lwydyby:wwmxd-log (>=1.0-release, <=1.0.9-release), com.ifrabbit:spring-boot-starter-data-mybatis (1.0.17.release) +69 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.5.release)

org.springframework.boot:spring-boot MAVEN version 1.5.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.gitee.lwydyby:wwmxd-log =1.0-release, =0.12.0, =4.7.0, =0.9.6.1, =1.3.3,...

com.github.advantageous:qbit-spring (>=0.9.1-rc11, <=0.9.2-rc14), com.github.jmgilmour:parker-spring-boot (0.1.0) +165 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.2.6.release)

org.springframework.boot:spring-boot MAVEN version 1.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.github.advantageous:qbit-spring =0.9.1-rc11, =2.0.1, =2.2.29, =1.0.4, =1.0....

com.devskiller.friendly-id:friendly-id-openfeign (>=2.0.0-alpha3, <=2.0.0-beta6), io.github.bluetape4k:bluetape4k-spring-boot4-cassandra (>=1.5.0-beta2, <=1.7.0) +19 more potentially affected by CVE-2026-40977 via org.springframework.boot:spring-boot-cassandra (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot-cassandra MAVEN version =4.0.0, =2.0.0-alpha3, =1.5.0-beta2, =0.8.0, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0...

cc.catalysts.boot:cat-boot-javamelody (0.0.4), cn.bestwu:data-rest (1.0.0.m1) +191 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.3.1.release)

org.springframework.boot:spring-boot MAVEN version 1.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cc.catalysts.boot:cat-boot-javamelody 0.0.4 - cn.bestwu:data-rest 1.0.0.m1 -...

com.devskiller.friendly-id:friendly-id-openfeign (>=2.0.0-alpha3, <=2.0.0-beta6), io.github.bluetape4k:bluetape4k-spring-boot4-cassandra (>=1.5.0-beta2, <=1.7.0) +19 more potentially affected by CVE-2026-40974 via org.springframework.boot:spring-boot-cassandra (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot-cassandra MAVEN version =4.0.0, =2.0.0-alpha3, =1.5.0-beta2, =0.8.0, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0...