ch.rasc:embeddedtc (1.28), ch.rasc:embeddedtc-maven-plugin (1.22) +4 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (7.0.79)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.79 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ch.rasc:embeddedtc 1.28 - ch.rasc:embeddedtc-maven-plugin 1.22 -...

net.unit8.waitt.server:waitt-tomcat7 (1.3.0), org.apache.tomcat.embed:tomcat-embed-jasper (7.0.109) +3 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (7.0.109)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.109 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - net.unit8.waitt.server:waitt-tomcat7 1.3.0 -...

ch.rasc:embeddedtc (1.21), ch.rasc:embeddedtc-maven-plugin (1.16) +2 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (7.0.63)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.63 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ch.rasc:embeddedtc 1.21 - ch.rasc:embeddedtc-maven-plugin 1.16 -...

ch.rasc:embeddedtc (1.1), org.apache.tomcat.embed:tomcat-embed-jasper (7.0.30) +3 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (7.0.30)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.30 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ch.rasc:embeddedtc 1.1 - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.30 ...

ch.rasc:embeddedtc (1.6), ch.rasc:embeddedtc-maven-plugin (1.3) +4 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (7.0.39)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.39 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ch.rasc:embeddedtc 1.6 - ch.rasc:embeddedtc-maven-plugin 1.3 -...

ch.rasc:embeddedtc (1.21), ch.rasc:embeddedtc-maven-plugin (1.16) +2 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (7.0.63)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.63 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ch.rasc:embeddedtc 1.21 - ch.rasc:embeddedtc-maven-plugin 1.16 -...

io.micronaut.build:micronaut-maven-plugin (2.0.0), io.micronaut.jms:micronaut-jms-activemq-artemis (1.0.0.m2) +32 more potentially affected by CVE-2026-44242 via io.micronaut:micronaut-inject (2.4.3)

io.micronaut:micronaut-inject MAVEN version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-inject and may be impacted: - io.micronaut.build:micronaut-maven-plugin 2.0.0 - io.micronaut.jms:micronaut-jms-activemq-artemis...

com.apigee.edge.config:apigee-config-maven-plugin (>=1.0, <=2.9.3), com.apigee.registry.config:apigee-registry-maven-plugin (>=1.0.0-beta, <=1.0.2) +43 more potentially affected by CVE-2026-42404 via org.apache.neethi:neethi (2.0.2)

org.apache.neethi:neethi MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.neethi:neethi and may be impacted: - com.apigee.edge.config:apigee-config-maven-plugin =1.0, =1.0.0-beta, =1.0.0, =1.0.0, =2.5.2 -...

com.apigee.edge.config:apigee-config-maven-plugin (>=1.0, <=2.9.3), com.apigee.registry.config:apigee-registry-maven-plugin (>=1.0.0-beta, <=1.0.2) +43 more potentially affected by CVE-2026-42403 via org.apache.neethi:neethi (2.0.2)

org.apache.neethi:neethi MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.neethi:neethi and may be impacted: - com.apigee.edge.config:apigee-config-maven-plugin =1.0, =1.0.0-beta, =1.0.0, =1.0.0, =2.5.2 -...

org.keycloak:keycloak-dependencies-admin-ui-wrapper (20.0.4), org.keycloak:keycloak-dependencies-server-all (20.0.4) +10 more potentially affected by CVE-2026-7500 via org.keycloak:keycloak-services (20.0.4)

org.keycloak:keycloak-services MAVEN version 20.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-admin-ui-wrapper 20.0.4 -...

com.exadel.flamingo.maven.plugin:flamingoapp (>=1.0.0, <=1.5.0), org.acegisecurity:acegi-security (>=1.0.1, <=1.0.2) +19 more potentially affected by CVE-2026-22745 via org.springframework:spring-webmvc (1.2.7)

org.springframework:spring-webmvc MAVEN version 1.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.exadel.flamingo.maven.plugin:flamingoapp =1.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1,...

org.acegisecurity:acegi-security-samples-contacts (1.0.7), org.andromda.andromdapp.projects:andromda-andromdapp-project-richclient-ant (3.3) +1 more potentially affected by CVE-2026-22745 via org.springframework:spring-webmvc (1.2.9)

org.springframework:spring-webmvc MAVEN version 1.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.acegisecurity:acegi-security-samples-contacts 1.0.7 -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (1.0.4), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (1.0.4) +4 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.4.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.avioconsulting.maven:ics-maven-plugin (1.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=0.0.2, <=0.0.5) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.0.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.avioconsulting.maven:ics-maven-plugin 1.0 -...

This Week in Spring - April 28th, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring! As I write this, I'm on PTO in beautiful Santorini, Greece, catching up on some news and about to cruise the islands for some sightseeing. There's nothing quite like springtime in the Mediterranean! I couldn't dream of enjoyin...

com.github.linyuzai:concept-plugin-spring-boot-starter (>=2.0.0, <=3.0.0), de.gematik.test.tiger:tiger-on-fhir (>=1.1.1, <=1.2.1) +6 more potentially affected by CVE-2026-42037 via org.webjars.npm:axios (>=1.4.0, <=1.7.2)

org.webjars.npm:axios MAVEN version =1.4.0, =2.0.0, =1.1.1, =2.1.1, =2.1.1, =2.1.1, =2.1.3, =2.1.1, =1.0.6, =1.0.9 Source cves: CVE-2026-42037 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16299820...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.2.3) +5 more potentially affected by CVE-2026-41043 via org.apache.activemq:activemq-all (>=6.0.0, <=6.2.3)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.3 Source cves: CVE-2026-41043 Source advisory: OSV:GHSA-2JP3-2923-9H52...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.2.3) +5 more potentially affected by CVE-2026-40466 via org.apache.activemq:activemq-all (>=6.0.0, <=6.2.3)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.3 Source cves: CVE-2026-40466 Source advisory: MEND:CVE-2026-40466...

dev.dsf:dsf-maven-plugin (>=2.0.0-m3, <=2.0.2) potentially affected by CVE-2026-40942 via dev.dsf:dsf-bpe-process-api-v2 (>=2.0.0-m3, <=2.0.2)

dev.dsf:dsf-bpe-process-api-v2 MAVEN version =2.0.0-m3, =2.0.0-m3, =2.0.2 Source cves: CVE-2026-40942 Source advisory: MEND:CVE-2026-40942...

com.checkmarx.maven:checkmarx-maven-plugin (9.00.3), com.checkmarx:cx-client-common (>=2021.1.135, <=2023.1.7) +19 more potentially affected by CVE-2026-41245 via com.github.junrar:junrar (1.0.1)

com.github.junrar:junrar MAVEN version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.junrar:junrar and may be impacted: - com.checkmarx.maven:checkmarx-maven-plugin 9.00.3 - com.checkmarx:cx-client-common =2021.1.135, =20.0.10,...