Spring Boot Actuator Heap Dump

Detects exposed Spring Boot Actuator heapdump endpoints that can leak JVM memory, secrets, and HTTP traffic. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot Actuator heapdump exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHS = "/heapdump",...

Spring Boot Actuator Detection

Detects exposed Spring Boot Actuator health, env, and heapdump endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Spring Boot Actuator endpoints.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.probeguard import...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management in the permission enforcement process for sensitive actuator endpoints such as heapdump, env, and threaddump. An attacker can access sensitive application data by authenticating with only restricted...

Improper Privilege Management

Overview Steeltoe.Management.Endpoint is a package that provides building blocks for development of .NET applications that integrate with Spring and Spring Boot environments, as well as Cloud Foundry and Kubernetes with first-party support for Tanzu. Affected versions of this package are vulnerab...

CVE-2026-50201 Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, all Steeltoe actuator endpoints default to...

EUVD-2025-20090

Malicious code in bioql PyPI...

EUVD-2022-4826

Malicious code in bioql PyPI...

CVE-2025-53602

Zipkin through 3.5.1 has a /heapdump endpoint associated with the use of Spring Boot Actuator, a similar issue to CVE-2025-48927...

Exposure of Core Dump File to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Core Dump File to an Unauthorized Control Sphere via the heapdump endpoint, which is introduced through the use of Spring Boot Actuators. An attacker can access sensitive memory information by sending requests to this...

Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint

Zipkin through 3.5.1 has a /heapdump endpoint associated with the use of Spring Boot Actuator, a similar issue to CVE-2025-48927...

GHSA-794X-8X6X-QPFC Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint

Zipkin through 3.5.1 has a /heapdump endpoint associated with the use of Spring Boot Actuator, a similar issue to CVE-2025-48927...

CVE-2025-53602

Zipkin through 3.5.1 has a /heapdump endpoint associated with the use of Spring Boot Actuator, a similar issue to CVE-2025-48927...

CVE-2025-53602

CVE-2025-53602 affects Zipkin up to version 3.5.1 with a /heapdump endpoint (via Spring Boot Actuator). The root cause is exposure of sensitive heap memory information leading to potential information disclosure. The CVE is linked to related advisories (e.g., GHSA-794X-8X6X-QPFC) describing insec...

CVE-2025-53602

Zipkin through 3.5.1 has a /heapdump endpoint associated with the use of Spring Boot Actuator, a similar issue to CVE-2025-48927...

CVE-2025-53602

Zipkin through 3.5.1 has a /heapdump endpoint associated with the use of Spring Boot Actuator, a similar issue to CVE-2025-48927...

CVE-2025-53602

Zipkin through 3.5.1 has a /heapdump endpoint associated with the use of Spring Boot Actuator, a similar issue to CVE-2025-48927...

CVE-2025-53602: Initialization of a Resource with an Insecure Default

Zipkin through 3.5.1 has a /heapdump endpoint associated with the use of Spring Boot Actuator, a similar issue to CVE-2025-48927...

CVE-2025-53602

Zipkin through 3.5.1 has a /heapdump endpoint associated with the use of Spring Boot Actuator, a similar issue to CVE-2025-48927...

Zipkin security vulnerabilities

zipkin is a distributed tracking system open-sourced by Open Zipkin. A security vulnerability exists in zipkin 3.5.1 and earlier versions, which originates from an attacker who can access sensitive system memory information via the /heapdump endpoint, leading to information disclosure...

VulnCheck KEV: CVE-2025-48927

TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI...