cloud.subzero:subzero (>=2.0.8, <=3.0.1), cn.hiauth:hiauth-client-session-spring-boot-starter (3.0.0) +440 more potentially affected by CVE-2025-66614 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.14)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =2.0.8, =7.0.0-m1, =3.1.0, =3.0.0, =3.0.0, =4.1.0 - co.ipregistry:ipregistry-spring-boot-mvc 1.0.0 - co.ipregistry:ipregistry-spring-boot-webflux 1.0.0 - com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-model-chat-memory-mem0...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +13633 more potentially affected by CVE-2025-66614 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.112)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2025-66614 Source advisory: MEND:CVE-2025-66614...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +8332 more potentially affected by CVE-2025-66614 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.1.49)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-66614 Source advisory:...

Incorrect Authorization

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Incorrect Authorization when using an OCSP responder. OCSP response verification and freshness checks can be bypassed, allowing certificate revocation to be...

cloud.subzero:subzero (>=2.0.8, <=3.0.1), cn.hiauth:hiauth-client-session-spring-boot-starter (3.0.0) +440 more potentially affected by CVE-2025-66614 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.14)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =2.0.8, =7.0.0-m1, =3.1.0, =3.0.0, =3.0.0, =4.1.0 - co.ipregistry:ipregistry-spring-boot-mvc 1.0.0 - co.ipregistry:ipregistry-spring-boot-webflux 1.0.0 - com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-model-chat-memory-mem0...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +13633 more potentially affected by CVE-2026-24733 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.112)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2026-24733 Source advisory: SNYK:JAVA-ORGAPACHETOMCATEMBED-15307825...

ai.platon.pulsar:pulsar-e2e-tests (>=4.5.0, <=4.6.0), ai.platon.pulsar:pulsar-it-tests (>=4.5.0, <=4.6.0) +813 more potentially affected by CVE-2026-24734 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.15)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =0.1.1, =0.2.0, =0.2.0, =0.3.0 - br.com.sawcunhaos:scos-foundation-audit 1.0.0 - br.com.sawcunhaos:scos-foundation-exception 1.0.0 - br.com.sawcunhaos:scos-foundation-jdempotent 1.0.0 -...

ai.chat2db.excel:easyexcel-plus-test (0.0.1), au.csiro.pathling:fhir-server (>=6.4.0, <=6.4.2) +2359 more potentially affected by CVE-2026-24734 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.83, <=9.0.113)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.83, =6.4.0, =2.3.0, =2.3.0, =2.4.1 - au.org.consumerdatastandards:mock-data-holder-java 2.6.0 - cc.chensoul.nacos:core-test 2.5.2 - cc.chensoul.nacos:nacos-address 2.5.2 - cc.chensoul.nacos:nacos-auth 2.5.2 - cc.chensoul.nacos:nacos-cmd...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +8315 more potentially affected by CVE-2026-24733 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.49)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-24733 Source advisory:...

Improper Certificate Validation

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Improper Certificate Validation in the SNI extension, when client certificate authentication relies exclusively on the Connector and is not enforced in the web...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +8498 more potentially affected by CVE-2026-24734 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m7, <=10.1.50)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m7, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-24734 Source advisory:...

cloud.subzero:subzero (>=2.0.8, <=3.0.1), cn.hiauth:hiauth-client-session-spring-boot-starter (3.0.0) +440 more potentially affected by CVE-2026-24733 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.14)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =2.0.8, =7.0.0-m1, =3.1.0, =3.0.0, =3.0.0, =4.1.0 - co.ipregistry:ipregistry-spring-boot-mvc 1.0.0 - co.ipregistry:ipregistry-spring-boot-webflux 1.0.0 - com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-model-chat-memory-mem0...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +16676 more potentially affected by CVE-2025-66614 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=9.0.112)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2025-66614 Source advisory: SNYK:JAVA-ORGAPACHETOMCATEMBED-15307781...

wagtail-stacks-embed (>=0.1.0, <=0.3.0) potentially affected by CVE-2026-25517 via wagtail (1.7.0)

wagtail PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-stacks-embed =0.1.0, =0.3.0 Source cves: CVE-2026-25517 Source advisory: OSV:GHSA-4QVV-G3VR-M348...

WordPress PowerBI Embed Reports plugin <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin PowerBI Embed Reports versions = 1.1.7...

Malware in dotenv-embed

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in dotenv-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bbecb8b9bb96fcd71af0764df5106d8163ccb94c21960bf858383ab85d10308 The package dotenv-embed was found to contain malicious code. Source: ghsa-malware eb5a7942b654b4da1fb16e67f19ca82b3b52c4fcce4db85e9d5596571651c6b7 A...

MAL-2026-589 Malicious code in dotenv-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bbecb8b9bb96fcd71af0764df5106d8163ccb94c21960bf858383ab85d10308 The package dotenv-embed was found to contain malicious code. Source: ghsa-malware eb5a7942b654b4da1fb16e67f19ca82b3b52c4fcce4db85e9d5596571651c6b7 A...

Malicious Package

Overview dotenv-embed is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-1389: Authorization Bypass Through User-Controlled Key

The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4. This is due to the plugin not verifying that a user has permission to access the requested resource in the...