Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' through the composition lookup. An attacker can manipulate the base function by injecting malicious components during the lookup process,...

Missing Authentication for Critical Function

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the monitor endpoint, which does not validate incomi...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=9.3.0) +558 more potentially affected by CVE-2026-59291 via org.springframework.cloud:spring-cloud-function-context (>=4.2.0, <=5.0.3)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.2.0, =17.16.0, =5.0.5, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =3.5.5.2 and more Source cves: CVE-2026-59291https...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the env actuator endpoint when no allow list is enforced for property keys. An attacker can modify arbitrary environment properties by sending crafted requests to the writable endpoint. Note: This is only...

cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN

cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN...

cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests...

cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure

cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure...

org.springframework.cloud:spring-cloud-stream-schema-registry-server (>=4.2.2, <=5.0.2) potentially affected by CVE-2026-59304 via org.springframework.cloud:spring-cloud-stream-schema-registry-core (>=4.2.2, <=5.0.2)

org.springframework.cloud:spring-cloud-stream-schema-registry-core MAVEN version =4.2.2, =4.2.2, =5.0.2 Source cves: CVE-2026-59304 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267416...

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting in the processing of HTTP headers. An attacker can inject or manipulate HTTP headers by sending specially crafted requests. Remediation Upgrade org.springframework.cloud:spring-cloud-function-web to version 5.0.4...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the logging. An attacker can access sensitive information by reviewing application logs under certain conditions. Remediation Upgrade org.springframework.cloud:spring-cloud-stream to...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the function that processes input data. An attacker can access arbitrary files or make unauthorized network requests by supplying crafted input that is improperly handled. Remediation Upgrade...

CVE-2026-72846: Server-Side Request Forgery (SSRF)

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=9.3.0) +466 more potentially affected by CVE-2026-59303 via org.springframework.cloud:spring-cloud-stream (>=4.2.0, <=5.0.2)

org.springframework.cloud:spring-cloud-stream MAVEN version =4.2.0, =17.16.0, =5.0.5, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =3.5.5.2 and more Source cves: CVE-2026-59303https://vulners.com/cve/C...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=9.3.0) +466 more potentially affected by CVE-2026-59305 via org.springframework.cloud:spring-cloud-stream (>=4.2.0, <=5.0.2)

org.springframework.cloud:spring-cloud-stream MAVEN version =4.2.0, =17.16.0, =5.0.5, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =3.5.5.2 and more Source cves: CVE-2026-59305https://vulners.com/cve/C...

io.github.shuigedeng:taotao-cloud-demo (2025.12), io.github.shuigedeng:taotao-cloud-starter-alibaba (2025.12) +38 more potentially affected by CVE-2026-59298 via org.springframework.cloud:spring-cloud-function-web (>=5.0.0-m1, <=5.0.3)

org.springframework.cloud:spring-cloud-function-web MAVEN version =5.0.0-m1, =0.27.2, =0.27.2, =0.33.2, =0.33.2, =0.43.0 and more Source cves: CVE-2026-59298 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267406...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=9.3.0) +466 more potentially affected by CVE-2026-59302 via org.springframework.cloud:spring-cloud-stream (>=4.2.0, <=5.0.2)

org.springframework.cloud:spring-cloud-stream MAVEN version =4.2.0, =17.16.0, =5.0.5, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =3.5.5.2 and more Source cves: CVE-2026-59302https://vulners.com/cve/C...

com.limemojito.oss.standards.aws:lambda-sql (>=13.0.2, <=18.0.300), com.limemojito.oss.standards.aws:lambda-utilities (>=13.0.2, <=18.0.300) +50 more potentially affected by CVE-2026-59300 via org.springframework.cloud:spring-cloud-function-adapter-aws (>=5.0.0-m1, <=5.0.3)

org.springframework.cloud:spring-cloud-function-adapter-aws MAVEN version =5.0.0-m1, =13.0.2, =13.0.2, =13.0.2, =13.0.2, =13.0.2, =13.0.2, =0.40.0, =0.40.0, =0.27.2, =0.27.2, =0.27.2, =0.40.0, =0.39.0, =0.39.0, =0.27.2, =0.43.0 and more Source cves: CVE-2026-59300 Source advisory:...

PT-2026-79016

ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...

com.oracle.database.spring.cloud-stream-binder:spring-cloud-stream-binder-oracle-txeventq (>=0.20.0, <=0.21.0), com.solace.connector.core.io:spring-cloud-stream-binder-jms (5.0.1) +2 more potentially affected by CVE-2026-47880 via org.springframework.integration:spring-integration-jms (7.1.0)

org.springframework.integration:spring-integration-jms MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-jms and may be impacted: -...