com.battcn:spring-cloud-swagger-server (>=1.0.1-release, <=1.0.4-release), com.cedarsoft:spring (>=8.4.0, <=8.7.0) +607 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.5.8.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.5.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.battcn:spring-cloud-swagger-server...

ai.platon.pulsar:pulsar-e2e-tests (>=4.5.0, <=4.6.0), ai.platon.pulsar:pulsar-it-tests (>=4.5.0, <=4.6.0) +689 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (>=4.0.0-m1, <=4.0.3)

org.springframework.boot:spring-boot-starter-actuator MAVEN version =4.0.0-m1, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =3.1.0, =4.0.0 and more Source cves: CVE-2026-22733 Source advisory: OSV:GHSA-MGVC-8Q2H-5PGC...

Spring Boot has an Authentication Bypass under Actuator Health groups paths

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before...

com.vilt-group.minium:minium-app (0.9.3), de.codecentric:spring-boot-starter-batch-web (1.0.0.release) +1 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.0.2.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.vilt-group.minium:minium-app 0.9.3 -...

org.springframework.boot:spring-boot-starter-remote-shell (1.3.4.release) potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.3.4.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

ai.ancf.lmos:arc-runner (>=0.1.1, <=0.112.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.4.0) +3434 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (>=3.0.0, <=3.3.13)

org.springframework.boot:spring-boot-starter-actuator MAVEN version =3.0.0, =0.1.1, =0.0.4, =0.1.0, =cloud-0.1, =7.0.0, =2.10.0, =3.6.0, =3.6.1 and more Source cves: CVE-2026-22733 Source advisory: GHSA-MGVC-8Q2H-5PGC...

com.alibaba.spring.boot:dubbo-spring-boot-starter (>=1.0.1, <=2.0.0), com.almis.awe:awe-annotation (>=4.1.0, <=4.1.1) +138 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.5.10.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.5.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: -...

CVE-2026-22733

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from...

PT-2026-26702

Name of the Vulnerable Software and Affected Versions barebox versions 2016.03.0 through 2025.09.2 barebox versions 2025.10.0 through 2026.03.0 Description barebox is a bootloader. When creating a FIT Firmware Image Table, the mkimage1 function sets the hashed-nodes property of the FIT signature...

CVE-2026-33243: Insufficient Verification of Data Authenticity

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 and the corresponding backport to 2025.09.3, an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a...

CVE-2026-22733: Authentication Bypass Using an Alternate Path or Channel

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-runner (>=0.114.0, <=0.120.0) +2199 more potentially affected by CVE-2026-22735 via org.springframework:spring-webflux (>=6.2.0, <=6.2.16)

org.springframework:spring-webflux MAVEN version =6.2.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.7.0 and more Source cves: CVE-2026-22735 Source advisory: MEND:CVE-2026-22735...

ai.platon.pulsar:pulsar-e2e-tests (>=4.5.0, <=4.6.0), ai.platon.pulsar:pulsar-it-tests (>=4.5.0, <=4.6.0) +689 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (>=4.0.0-m1, <=4.0.3)

org.springframework.boot:spring-boot-starter-actuator MAVEN version =4.0.0-m1, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =3.1.0, =4.0.0 and more Source cves: CVE-2026-22733 Source advisory: MEND:CVE-2026-22733...

CVE-2026-22733

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from...

CVE-2026-22733 Authentication Bypass under Actuator CloudFoundry endpoints

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from...

CVE-2026-22733

Summary of CVE-2026-22733 : Affected are Spring Boot applications using Actuator with a misconfigured endpoint under the CloudFoundry Actuator path. The issue is described as an Authentication Bypass in several Spring Security versions (2.7.0–2.7.31, 3.3.0–3.3.17, 3.4.0–3.4.14, 3.5.0–3.5.11, 4.0....

CVE-2026-22733 Authentication Bypass under Actuator CloudFoundry endpoints

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from...

CVE-2026-22733 Authentication Bypass under Actuator CloudFoundry endpoints

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from...

CVE-2026-22731

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before...

CVE-2026-22731

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before...