io.awspring.cloud:spring-cloud-aws-starter-integration-sns (>=4.0.0-m1, <=4.2.0), org.citrusframework.mvn:citrus-maven-plugin (5.0.0-m1) +34 more potentially affected by CVE-2026-47864 via org.springframework.integration:spring-integration-http (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-http MAVEN version =7.0.0-m1, =4.0.0-m1, =4.2.0 - org.citrusframework.mvn:citrus-maven-plugin 5.0.0-m1 - org.citrusframework:citrus-agent-connector 5.0.0-m1 - org.citrusframework:citrus-cucumber-all 5.0.0-m1 -...

Directory Traversal

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Directory Traversal via the native environment repository process. An attacker can access sensitive...

com.github.piomin:spring-cloud-schema-registry-client-apicurio (>=1.4.0, <=2.0.0) potentially affected by CVE-2026-59304 via org.springframework.cloud:spring-cloud-stream-schema-registry-client (>=4.3.1, <=5.0.0)

org.springframework.cloud:spring-cloud-stream-schema-registry-client MAVEN version =4.3.1, =1.4.0, =2.0.0 Source cves: CVE-2026-59304 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267415...

br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0), br.com.sawcunhaos:scos-foundation-exception (>=1.0.0, <=1.1.0) +1096 more potentially affected by CVE-2026-59284 via org.springframework.cloud:spring-cloud-context (>=5.0.0-m1, <=5.0.2)

org.springframework.cloud:spring-cloud-context MAVEN version =5.0.0-m1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =5.0.0, =5.0.0, =5.0.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =8.0.0-alpha-springboot4, =8.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4,...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.2), org.openwms:org.openwms.configuration (3.0.0) potentially affected by CVE-2026-59315 via org.springframework.cloud:spring-cloud-config-monitor (>=5.0.0, <=5.0.4)

org.springframework.cloud:spring-cloud-config-monitor MAVEN version =5.0.0, =8.0.0-rc1, =8.0.2 - org.openwms:org.openwms.configuration 3.0.0 Source cves: CVE-2026-59315 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267421...

com.amazonaws.serverless:aws-serverless-java-container-springboot4 (>=3.0.0, <=3.0.3), org.springframework.cloud:spring-cloud-function-adapter-azure-web (>=4.2.0, <=5.0.3) potentially affected by CVE-2026-59297 via org.springframework.cloud:spring-cloud-function-serverless-web (>=4.2.0, <=5.0.3)

org.springframework.cloud:spring-cloud-function-serverless-web MAVEN version =4.2.0, =3.0.0, =4.2.0, =5.0.3 Source cves: CVE-2026-59297 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267419...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.3.0), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.1.0.1) +275 more potentially affected by CVE-2026-59299 via org.springframework.cloud:spring-cloud-function-context (>=5.0.0-m1, <=5.0.3)

org.springframework.cloud:spring-cloud-function-context MAVEN version =5.0.0-m1, =8.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =1.0.0, =1.0.0, =1.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 and more Source cves: CVE-2026-59299 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267413...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through the spring.cloud.config.server.svn.basedir...

cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint

cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint...

ch.nexsol-tech.gateway:config-server (>=1.6.0, <=1.7.0), net.sf.tsl2nano:tsl3-beanui (0.0.2) +6 more potentially affected by CVE-2026-47837 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.4)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =1.6.0, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.2 Source cves: CVE-2026-47837 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267445...

ch.nexsol-tech.gateway:config-server (>=1.6.0, <=1.7.0), net.sf.tsl2nano:tsl3-beanui (0.0.2) +6 more potentially affected by CVE-2026-47894 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.4)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =1.6.0, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.2 Source cves: CVE-2026-47894 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267446...

ch.nexsol-tech.gateway:config-server (>=1.6.0, <=1.7.0), net.sf.tsl2nano:tsl3-beanui (0.0.2) +6 more potentially affected by CVE-2026-47836 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.4)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =1.6.0, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.2 Source cves: CVE-2026-47836 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267449...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization. An attacker can execute arbitrary code or manipulate application behavior by supplying specially crafted input that is deserialized without proper validation. Details Serializati...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the logging process. An attacker can access sensitive information by triggering specific log events under certain conditions. Remediation Upgrade...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the logging process. An attacker can obtain sensitive information by accessing logs that may inadvertently contain confidential data. Remediation Upgrade...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the process that handles incoming payloads. An attacker can cause service disruption by sending specially crafted malicious payloads. Remediation Upgrade...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper restriction of the dynamic destination cache size. An attacker can cause unintended information disclosure or modification by exploiting the lack of proper bounds on t...

Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the isSecure function of ServerlessHttpServletRequest due to not verifying the actual scheme. An attacker can potentially access or modify sensitive information by exploiting this improper security che...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the partition interceptor. An attacker can cause unauthorized modification or disclosure of message data by manipulating the message sending process. Remediation Upgrade...