com.farao-community.farao:gridcapa-core-cc-data-bridge (>=1.3.0, <=1.6.0), com.farao-community.farao:gridcapa-data-bridge (>=2.4.0, <=2.7.0) potentially affected by CVE-2026-59311 via org.springframework.integration:spring-integration-zip (6.5.0)

org.springframework.integration:spring-integration-zip MAVEN version 6.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-zip and may be impacted: -...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the SerializingHttpMessageConverter process. An attacker can execute arbitrary code by sending a specially crafted HTTP request with the Content-Type set to application/x-java-serialized-object and a...

ch.sbb:spring-cloud-stream-binder-solace (>=9.1.0, <=9.3.0), cn.herodotus.dante:dante-authentication-autoconfigure (4.1.0.1) +522 more potentially affected by CVE-2026-59322 via org.springframework.integration:spring-integration-core (7.1.0)

org.springframework.integration:spring-integration-core MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-core and may be impacted: - ch.sbb:spring-cloud-stream-binder-solace =9.1.0,...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the UDP inbound adapter process. An attacker can cause the server to send outbound UDP datagrams to arbitrary internal or external hosts and ports by sending specially crafted UDP packets containing...

org.springframework.cloud.fn:spring-syslog-supplier (6.0.0) potentially affected by CVE-2026-47859 via org.springframework.integration:spring-integration-syslog (7.0.4)

org.springframework.integration:spring-integration-syslog MAVEN version 7.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-syslog and may be impacted: -...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition via the ScriptEngine process. An attacker can access sensitive data from other requests or cause unexpected exceptions by triggering concurrent script evaluations. Remediation Upgrade...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the decodeNativeFormat. An attacker can inject arbitrary entries into MessageHeaders, including sensitive control headers, by sending...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the RFC6587SyslogDeserializer. An attacker can cause excessive memory consumption and potentially exhaust system resources by sending frames with arbitrarily large declared lengths...

org.springframework.cloud.fn:spring-syslog-supplier (6.0.0), org.springframework.cloud.fn:spring-tcp-common (6.0.0) +7 more potentially affected by CVE-2026-47861 via org.springframework.integration:spring-integration-ip (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-ip MAVEN version =7.0.0-m1, =7.0.0-m1, =7.0.5 Source cves: CVE-2026-47861 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKINTEGRATION-19267411...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3) +730 more potentially affected by CVE-2026-59322 via org.springframework.integration:spring-integration-core (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-core MAVEN version =7.0.0-m1, =8.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 -...

org.springframework.integration:spring-integration-groovy (>=7.0.0-m1, <=7.0.5) potentially affected by CVE-2026-59321 via org.springframework.integration:spring-integration-scripting (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-scripting MAVEN version =7.0.0-m1, =7.0.0-m1, =7.0.5 Source cves: CVE-2026-59321 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKINTEGRATION-19265077...

org.springframework.integration:spring-integration-groovy (7.1.0) potentially affected by CVE-2026-59321 via org.springframework.integration:spring-integration-scripting (7.1.0)

org.springframework.integration:spring-integration-scripting MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-scripting and may be impacted: -...

org.springframework.integration:spring-integration-syslog (7.1.0) potentially affected by CVE-2026-47861 via org.springframework.integration:spring-integration-ip (7.1.0)

org.springframework.integration:spring-integration-ip MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ip and may be impacted: -...

io.gitee.gzcltech.job:job-spring-scheduler-starter-jdbc (>=4.0.0-rc3, <=4.2.4), io.github.shuigedeng:taotao-boot-demo (>=2025.02, <=2025.07) +36 more potentially affected by CVE-2026-59307 via org.springframework.integration:spring-integration-jdbc (>=6.4.0, <=7.0.5)

org.springframework.integration:spring-integration-jdbc MAVEN version =6.4.0, =4.0.0-rc3, =2025.02, =2025.02, =2025.02, =2025.02, =2025.02, =2025.02, =2025.02, =2025.02, =2025.02, =7.2.0-rc3, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.4 and more Source cves: CVE-2026-59307 Source advisory:...

com.farao-community.farao:gridcapa-core-cc-data-bridge (>=1.3.0, <=1.6.0), com.farao-community.farao:gridcapa-data-bridge (>=2.4.0, <=2.7.0) potentially affected by CVE-2026-47862 via org.springframework.integration:spring-integration-zip (6.5.0)

org.springframework.integration:spring-integration-zip MAVEN version 6.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-zip and may be impacted: -...

com.farao-community.farao:gridcapa-core-cc-data-bridge (>=1.3.0, <=1.6.0), com.farao-community.farao:gridcapa-data-bridge (>=2.4.0, <=2.7.0) potentially affected by CVE-2026-59274 via org.springframework.integration:spring-integration-zip (6.5.0)

org.springframework.integration:spring-integration-zip MAVEN version 6.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-zip and may be impacted: -...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the ZipTransformer process. An attacker can overwrite or plant files in arbitrary directories by pre-creating a symbolic link at /tmp/ziptransformer before the application starts, causing extracted archive contents an...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the UnZipTransformer process. An attacker can exhaust system memory and cause service outages by submitting specially crafted zip archives with excessive decompressed...

Cleartext Transmission of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information via the negotiation process. An attacker can intercept or alter files transferred and capture authentication credentials by performing a downgrade attack on the SMB protocol. Remediation...

ggshield v1.54.0-rc1

ggshield: protect your code with GitGuardian ggshield is a CLI application that runs in your local environment or in a CI environment to help you detect more than 500+ types of secrets. ggshield uses our public API through py-gitguardian to scan and detect potential vulnerabilities in files and...