org.springframework.boot:spring-boot-starter-remote-shell (1.1.1.release) potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.1.1.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

ai.ancf.lmos:arc-runner (>=0.1.1, <=0.112.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.4.0) +3434 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (>=3.0.0, <=3.3.13)

org.springframework.boot:spring-boot-starter-actuator MAVEN version =3.0.0, =0.1.1, =0.0.4, =0.1.0, =cloud-0.1, =7.0.0, =2.10.0, =3.6.0, =3.6.1 and more Source cves: CVE-2026-22733 Source advisory: GHSA-MGVC-8Q2H-5PGC...

com.alibaba.spring.boot:dubbo-spring-boot-starter (>=1.0.1, <=2.0.0), com.almis.awe:awe-annotation (>=4.1.0, <=4.1.1) +138 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.5.10.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.5.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

io.fabric8:process-spring-boot-container (>=1.1.0.cr3, <=1.1.0.cr5), io.fabric8:process-spring-boot-itests-invoicing (1.1.0.cr3) +2 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.1.3.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - io.fabric8:process-spring-boot-container...

ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.4-sb1x, <=0.1.4-sb1x_6) +53 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.3.0.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

com.github.zed-platform:zed-panel (>=0.0.18, <=0.0.19), com.github.zed-platform:zed-shell (>=0.0.12, <=0.0.19) +19 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.2.1.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.github.zed-platform:zed-panel =0.0.18,...

am.ik.home:uaa-server (1.9.0), br.jus.stf.digital:core (>=2.0.0, <=2.3.1) +310 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.5.2.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.5.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - am.ik.home:uaa-server 1.9.0 -...

box.tapsi.libs:metrics-core (>=1.0.0, <=1.0.5), box.tapsi.libs:scheduler-starter (>=0.9.0, <=1.0.1) +1679 more potentially affected by CVE-2026-22731 via org.springframework.boot:spring-boot-starter-actuator (>=3.5.0, <=3.5.11)

org.springframework.boot:spring-boot-starter-actuator MAVEN version =3.5.0, =1.0.0, =0.9.0, =1.0.0, =1.24.0, =1.24.0, =1.24.0, =2.8.0, =2.8.0, =2.8.0, =0.0.1, =0.0.13, =0.0.1, =0.0.1, =2.14.0, =3.34.0, =4.18.0 and more Source cves: CVE-2026-22731 Source advisory: OSV:GHSA-8HFC-FQ58-R658...

com.github.totyumengr:minicubes-cluster (0.2), de.codecentric:spring-boot-starter-batch-web (1.1.0.release) +2 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.1.4.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.github.totyumengr:minicubes-cluster 0.2 -...

box.tapsi.libs:metrics-core (>=1.0.0, <=1.0.5), box.tapsi.libs:scheduler-starter (>=0.9.0, <=1.0.1) +1679 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (>=3.5.0, <=3.5.11)

org.springframework.boot:spring-boot-starter-actuator MAVEN version =3.5.0, =1.0.0, =0.9.0, =1.0.0, =1.24.0, =1.24.0, =1.24.0, =2.8.0, =2.8.0, =2.8.0, =0.0.1, =0.0.13, =0.0.1, =0.0.1, =2.14.0, =3.34.0, =4.18.0 and more Source cves: CVE-2026-22733 Source advisory: OSV:GHSA-MGVC-8Q2H-5PGC...

club.zhcs:axe-sigar (>=1.5.14, <=1.5.14.1), club.zhcs:distributed-job-admin (1.0) +342 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.5.14.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.5.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - club.zhcs:axe-sigar =1.5.14, =2.19.10.0,...

Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from...

com.alibaba.cloud:spring-cloud-alibaba-sentinel-gateway (1.5.1.release), com.alibaba.cloud:spring-cloud-starter-bus-rocketmq (1.5.1.release) +35 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.5.21.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.5.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

EUVD-2026-13349

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from...

cn.home1:oss-lib-adminclient-spring-boot-1.4.2.release (>=1.0.7.oss, <=1.0.8.oss), com.alibaba.cloud:spring-cloud-starter-acm (>=1.0.1, <=1.0.6) +156 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.4.2.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

de.codecentric:spring-boot-starter-batch-web (1.3.0.release), org.springframework.boot:spring-boot-starter-remote-shell (1.1.8.release) +6 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.1.8.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - de.codecentric:spring-boot-starter-batch-web...

com.epam.reportportal:commons-bugtracking (3.0.0), com.github.wu191287278:spring-boot-starter-dubbo (1.4.5) +58 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.4.5.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.4.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.epam.reportportal:commons-bugtracking 3.0...

am.ik.home:uaa-server (>=1.3.0, <=1.8.1), br.jus.stf.digital:core (>=0.2.0, <=1.6.0) +62 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.5.1.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.5.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - am.ik.home:uaa-server =1.3.0, =0.2.0, =6.2.0....

cn.home1:oss-admin (>=1.0.6.oss, <=1.0.7.oss), cn.home1:oss-configserver (>=1.0.6.oss, <=1.0.7.oss) +635 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.4.1.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.4.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - cn.home1:oss-admin =1.0.6.oss, =1.0.6.oss,...

com.17jee:e-cloud-gateway (3.0.0.release), com.17jee:e-cloud-oauth (3.0.0.release) +23 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.3.6.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.3.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.17jee:e-cloud-gateway 3.0.0.release -...