EUVD-2026-13893

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2025.09.3 and from version 2025.10.0 to before version 2026.03.1, when creating a FIT, mkimage1 sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing...

CVE-2026-33243

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 and the corresponding backport to 2025.09.3, an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a...

CVE-2026-33243 barebox: FIT Signature Verification Bypass Vulnerability

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 and the corresponding backport to 2025.09.3, an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a...

CVE-2026-33243 barebox: FIT Signature Verification Bypass Vulnerability

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 and the corresponding backport to 2025.09.3, an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a...

CVE-2026-33243

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 and the corresponding backport to 2025.09.3, an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a...

CVE-2026-22731

A flaw was found in Spring Boot. This vulnerability, an authentication bypass, occurs when an application endpoint requiring authentication is declared under a specific path already configured for a Health Group additional path. A remote attacker could exploit this to bypass authentication,...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the configuration of endpoints under paths already assigned to Health Group additional paths. An attacker can gain unauthorized access to protected endpoints by sending reques...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the configuration of endpoints under paths already assigned to Health Group additional paths. An attacker can gain unauthorized access to protected endpoints by sending reques...

ai.ancf.lmos:arc-runner (>=0.1.1, <=0.114.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +5019 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=3.0.0, <=3.5.11)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =3.0.0, =0.1.1, =0.0.4, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =cloud-0.1, =0.6 - ai.ylyue:yue-library-base j17.3.3.1 - ai.ylyue:yue-library-base-crypto j17.3.3.1 and more Source...

ai.ancf.lmos:arc-runner (>=0.1.1, <=0.114.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +5510 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-actuator (>=3.0.0, <=3.5.11)

org.springframework.boot:spring-boot-actuator MAVEN version =3.0.0, =0.1.1, =0.0.4, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =cloud-0.1, =0.6 - ai.ylyue:yue-library-base j17.3.3.1 - ai.ylyue:yue-library-base-crypto j17.3.3.1 and more Source cves:...

com.garethahealy.poms:springboot-parent (1.0.0), com.garethahealy:springboot-parent (>=1.0.7, <=1.1.1) +25 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.3.1.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.garethahealy.poms:springboot-parent 1.0.0...

au.com.mountain-pass:hyperstate-server (>=1, <=10), be.ordina:microservices-dashboard-server (1.0.1) +191 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.4.0.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - au.com.mountain-pass:hyperstate-server =1,...

com.netflix.spectator:spectator-web-spring (>=0.41.0, <=0.42.0), org.apache.camel:camel-example-spring-boot (>=2.16.3, <=2.16.5) +8 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.2.8.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.netflix.spectator:spectator-web-spring...

ai.ancf.lmos:arc-runner (0.114.0), ai.ancf.lmos:lmos-operator (>=0.5.0, <=0.6.0) +1725 more potentially affected by CVE-2026-22731 via org.springframework.boot:spring-boot-starter-actuator (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot-starter-actuator MAVEN version =3.4.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =0.0.1, =0.1.0, =0.8.2 - cc.zzzyu.nacos:nacos-ai 3.1.1 and more Source cves: CVE-2026-22731 Source advisory: OSV:GHSA-8HFC-FQ58-R6...

GHSA-MGVC-8Q2H-5PGC Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from...

org.springframework.boot:spring-boot-starter-remote-shell (1.1.2.release) potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.1.2.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

box.tapsi.libs:metrics-core (>=1.0.0, <=1.0.5), box.tapsi.libs:scheduler-starter (>=0.9.0, <=1.0.1) +1679 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (>=3.5.0, <=3.5.11)

org.springframework.boot:spring-boot-starter-actuator MAVEN version =3.5.0, =1.0.0, =0.9.0, =1.0.0, =1.24.0, =1.24.0, =1.24.0, =2.8.0, =2.8.0, =2.8.0, =0.0.1, =0.0.13, =0.0.1, =0.0.1, =2.14.0, =3.34.0, =4.18.0 and more Source cves: CVE-2026-22733 Source advisory: GHSA-MGVC-8Q2H-5PGC...

am.ik.home:uaa-server (>=1.0.0, <=1.2.0), cn.chendahai:rocketmq-console-alarm (1.0.3) +65 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.4.3.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.4.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - am.ik.home:uaa-server =1.0.0, =3.0.1.2,...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.10, <=0.1.12), com.github.surpassm:liaoin-security-app (0.0.1.release) +7 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.5.15.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.5.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

com.vilt-group.minium:minium-app (0.9.6), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +4 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.1.7.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.vilt-group.minium:minium-app 0.9.6 -...