VMware Spring Integration 路径遍历漏洞

VMware Spring Integration is an enterprise application integration framework developed by VMware, Inc. Versions 7.0.0 to 7.0.4, 6.5.0 to 6.5.8, 6.4.0 to 6.4.11, 6.3.0 to 6.3.14, and 5.5.0 to 5.5.20 of VMware Spring Integration have a path traversal vulnerability. This vulnerability arises due to...

PT-2026-48615

Name of the Vulnerable Software and Affected Versions Spring Integration versions 7.0.0 through 7.0.4 Spring Integration versions 6.5.0 through 6.5.8 Spring Integration versions 6.4.0 through 6.4.11 Spring Integration versions 6.3.0 through 6.3.14 Spring Integration versions 5.5.0 through 5.5.20...

CVE-2026-0274

An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources...

Access Control Bypass

Overview org.springframework.data:spring-data-rest-webmvc is a maven plugin for Spring Data REST - WebMVC. Affected versions of this package are vulnerable to Access Control Bypass in the Querydsl integration, which accepts arbitrary persistent property paths as request-parameter filter keys...

EUVD-2026-35910

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

CVE-2026-41837

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

cn.herodotus.engine:message-sdk-mqtt (>=3.1.5.6 <=3.5.5.2), cn.herodotus.engine:message-spring-boot-starter (>=3.1.5.6 <=3.5.5.2) +70 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (>=6.0.0 <=6.5.8)

org.springframework.integration:spring-integration-file MAVEN version =6.0.0, =3.1.5.6, =3.1.5.6, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =1.0.0, =1.5.0, =1.4.0, =1.0, =1.0.0, =2.0.0-milestone-03, =2.0.0-milestone-02, =2.0.0-milestone-02, =2.0.0-milestone-11 and more Source cves: CVE-2026-40987ht...

org.springframework.integration:spring-integration-ftp (>=7.1.0-M1 <=7.1.0-RC1), org.springframework.integration:spring-integration-sftp (>=7.1.0-M1 <=7.1.0-RC1) +2 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (>=7.1.0-M1 <=7.1.0-RC1)

org.springframework.integration:spring-integration-file MAVEN version =7.1.0-M1, =7.1.0-M1, =7.1.0-M1, =7.1.0-M1, =7.1.0-M1, =7.1.0-RC1 Source cves: CVE-2026-40987 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKINTEGRATION-17308053...

Directory Traversal

Overview org.springframework.integration:spring-integration-file is a Spring Integration File Support Affected versions of this package are vulnerable to Directory Traversal via improper validation of file paths received from FTP, SFTP, or SMB servers. A malicious or compromised server can write...

PT-2026-48539

Name of the Vulnerable Software and Affected Versions opentelemetry-operator affected versions not specified Description The TargetAllocator in the OpenTelemetry Operator processes ServiceMonitor resources and converts endpoints into Prometheus scrape configurations. A tenant with permissions to...

PT-2026-48559

An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources...

io.awspring.cloud:spring-cloud-aws-starter-integration-s3 (>=4.0.0 <=4.0.2), org.eclipse.dirigible:dirigible-components-engine-ftp (>=12.94.0 <=13.2.0) +18 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (>=7.0.0-M1 <=7.0.4)

org.springframework.integration:spring-integration-file MAVEN version =7.0.0-M1, =4.0.0, =12.94.0, =13.2.0 - org.springframework.cloud.fn:spring-aws-s3-common =6.0.0 - org.springframework.cloud.fn:spring-file-common =6.0.0 - org.springframework.cloud.fn:spring-file-consumer =6.0.0 -...

cve-2026-40987 - HIGH - Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization

cve-2026-40987 - HIGH - Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization...

Directory Traversal

Overview org.springframework.integration:spring-integration-ftp is a Affected versions of this package are vulnerable to Directory Traversal. via improper validation of file paths received from FTP, SFTP, or SMB servers. A malicious or compromised server can write arbitrary files outside the...

CVE-2026-41837 Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

CVE-2026-41837 Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

CVE-2026-41837 Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

MAL-2026-5466 Malicious code in getd-eslint-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17328047b2ec8dce82cfbdfd5b16c8f862d51dca26b02c9801587c220a48975a On npm install, postinstall.js collects host identifiers os.hostname, os.userInfo username, os.platform, current working directory, CI environment...

Malicious code in getd-pantallas-cliente (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89a26267435645776aa984be114d5c657e63fa9937ff044e5ddd24943b28ea6e On npm install, postinstall.js collects os.hostname, os.userInfo.username, os.platform, process.cwd, and CI/build environment variables and sends the...

Malicious code in getd-typescript-eslint-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caed4b0db34232c4ef920817b6087cee9ac0610ec4ec2e49edbb5f167342f42f On npm install, the postinstall.js script collects the installer's hostname, OS username, platform, current working directory, CI environment markers...