com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-43514 Source advisory: OSV:GHSA-9M89-8FRQ-C98C...

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.31, <=9.0.117), org.apache.juddi:juddi-tomcat (>=3.3.6, <=3.3.10) +11 more potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat (>=9.0.10, <=9.0.117)

org.apache.tomcat:tomcat MAVEN version =9.0.10, =9.0.31, =3.3.6, =3.3.6, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =5.22.2, =8.0.0, =10.0.1 Source cves: CVE-2026-43514 Source advisory: OSV:GHSA-9M89-8FRQ-C98C...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-43512 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-43512 Source advisory: GHSA-H6FC-48RJ-7QQH...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-41284 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-41284 Source advisory: OSV:GHSA-GX5V-XP9W-J4CG...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-41284 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-41284 Source advisory: GHSA-GX5V-XP9W-J4CG...

com.github.hazendaz.tomcat:tomcat10-config (>=10.1.2, <=10.1.54), io.orqueio.bpm.tomcat:orqueio-bpm-tomcat (>=1.0.0, <=1.0.11) +12 more potentially affected by CVE-2026-41293 via org.apache.tomcat:tomcat (>=10.1.2, <=10.1.54)

org.apache.tomcat:tomcat MAVEN version =10.1.2, =10.1.2, =1.0.0, =1.0.0, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.5 Source cves: CVE-2026-41293 Source advisory: OSV:GHSA-R29C-68GH-XP6X...

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.31, <=9.0.117), org.apache.juddi:juddi-tomcat (>=3.3.6, <=3.3.10) +11 more potentially affected by CVE-2026-43513 via org.apache.tomcat:tomcat (>=9.0.10, <=9.0.117)

org.apache.tomcat:tomcat MAVEN version =9.0.10, =9.0.31, =3.3.6, =3.3.6, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =5.22.2, =8.0.0, =10.0.1 Source cves: CVE-2026-43513 Source advisory: GHSA-5MP6-JRQ3-R938...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-42498 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-42498 Source advisory: OSV:GHSA-FV25-8XCX-GQJC...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-41293 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-41293 Source advisory: OSV:GHSA-R29C-68GH-XP6X...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-43515 Source advisory: GHSA-5M62-PW8W-7W9F...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-43515 Source advisory: OSV:GHSA-5M62-PW8W-7W9F...

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.31, <=9.0.117), org.apache.juddi:juddi-tomcat (>=3.3.6, <=3.3.10) +12 more potentially affected by CVE-2026-41293 via org.apache.tomcat:tomcat (>=8.5.2, <=9.0.117)

org.apache.tomcat:tomcat MAVEN version =8.5.2, =9.0.31, =3.3.6, =3.3.6, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =5.21.0, =5.20.0, =8.0.0, =10.0.1 Source cves: CVE-2026-41293 Source advisory: GHSA-R29C-68GH-XP6X...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.21), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.21)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-43514 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-16643278...

com.github.hazendaz.tomcat:tomcat10-config (>=10.1.2, <=10.1.54), io.orqueio.bpm.tomcat:orqueio-bpm-tomcat (>=1.0.0, <=1.0.11) +12 more potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat (>=10.1.2, <=10.1.54)

org.apache.tomcat:tomcat MAVEN version =10.1.2, =10.1.2, =1.0.0, =1.0.0, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.5 Source cves: CVE-2026-43514 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-16643278...

Malicious code in @2oolkit/hyperliquid-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c3af30011dcf54950f270463028270d732fce20b5cd5da44342a0748922e6df The package is advertised as a neutral CLI/MCP wrapper for Hyperliquid, but its distributed code silently routes value from the installer to an...

CVE-2026-1185

A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited if an attacker can log in to the Axis device using SSH...

CVE-2026-1185

A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privilege escalation. This vulnerability can only be exploited if an attacker can log in to the Axis device using SSH...

CVE-2026-34263

Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application...

CVE-2026-34263

Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application...

This Week in Spring - May 12th, 2026

Hi, Spring fans! As I write this I am in Miami, FL at the CodeRemix.ai show, focused on the wide and wonderful world of OpenRewrite and Moderne. I've got a talk to give so let's dive right into it! a quick note about the upcoming release train dates in last week's installment of A Bootiful Podcas...