ch.rasc:embeddedtc (1.28), ch.rasc:embeddedtc-maven-plugin (1.22) +4 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (7.0.79)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.79 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ch.rasc:embeddedtc 1.28 - ch.rasc:embeddedtc-maven-plugin 1.22 -...

ch.rasc:embeddedtc (1.28), ch.rasc:embeddedtc-maven-plugin (1.22) +4 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (7.0.79)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.79 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ch.rasc:embeddedtc 1.28 - ch.rasc:embeddedtc-maven-plugin 1.22 -...

ch.rasc:embeddedtc (1.28), ch.rasc:embeddedtc-maven-plugin (1.22) +4 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (7.0.79)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.79 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ch.rasc:embeddedtc 1.28 - ch.rasc:embeddedtc-maven-plugin 1.22 -...

ch.rasc:embeddedtc (1.29), ch.rasc:embeddedtc-maven-plugin (1.23) +6 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (7.0.82)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.82 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ch.rasc:embeddedtc 1.29 - ch.rasc:embeddedtc-maven-plugin 1.23 -...

net.unit8.waitt.server:waitt-tomcat7 (1.3.0), org.apache.tomcat.embed:tomcat-embed-jasper (7.0.109) +3 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (7.0.109)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.109 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - net.unit8.waitt.server:waitt-tomcat7 1.3.0 -...

net.unit8.waitt.server:waitt-tomcat7 (1.3.0), org.apache.tomcat.embed:tomcat-embed-jasper (7.0.109) +3 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (7.0.109)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.109 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - net.unit8.waitt.server:waitt-tomcat7 1.3.0 -...

org.akhikhl.gretty:gretty-runner-tomcat8 (1.0.0), org.apache.tomcat.embed:tomcat-embed-jasper (8.0.8) +5 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.0.8)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.akhikhl.gretty:gretty-runner-tomcat8 1.0.0 -...

com.github.psi-probe:psi-probe-tomcat85 (3.5.1), org.apache.tomcat:tomcat-catalina-ha (8.5.57) +28 more potentially affected by CVE-2026-43513 via org.apache.tomcat:tomcat-catalina (8.5.57)

org.apache.tomcat:tomcat-catalina MAVEN version 8.5.57 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.github.psi-probe:psi-probe-tomcat85 3.5.1 - org.apache.tomcat:tomcat-catalina-ha 8.5.57 ...

com.googlecode.t7mp:maven-t7-common (>=0.9.10.m5, <=0.9.10.m6), com.googlecode.t7mp:maven-tomee-plugin (0.9.10.m3) +8 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (7.0.25)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.25 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.googlecode.t7mp:maven-t7-common =0.9.10.m5, =0.9.10.m6 -...

com.cloudera.oryx:oryx-lambda-serving (2.3.0), com.github.waffle:waffle-tomcat85 (1.8.3) +32 more potentially affected by CVE-2026-41284 via org.apache.tomcat:tomcat-catalina (8.5.11)

org.apache.tomcat:tomcat-catalina MAVEN version 8.5.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.cloudera.oryx:oryx-lambda-serving 2.3.0 - com.github.waffle:waffle-tomcat85 1.8.3 -...

com.googlecode.t7mp:maven-t7-common (>=0.9.10.m5, <=0.9.10.m6), com.googlecode.t7mp:maven-tomee-plugin (0.9.10.m3) +8 more potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat-catalina (7.0.25)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.25 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.googlecode.t7mp:maven-t7-common =0.9.10.m5, =0.9.10.m6 -...

io.micronaut.build:micronaut-maven-plugin (2.0.0), io.micronaut.jms:micronaut-jms-activemq-artemis (1.0.0.m2) +32 more potentially affected by CVE-2026-44242 via io.micronaut:micronaut-inject (2.4.3)

io.micronaut:micronaut-inject MAVEN version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-inject and may be impacted: - io.micronaut.build:micronaut-maven-plugin 2.0.0 - io.micronaut.jms:micronaut-jms-activemq-artemis...

com.apigee.edge.config:apigee-config-maven-plugin (>=1.0, <=2.9.3), com.apigee.registry.config:apigee-registry-maven-plugin (>=1.0.0-beta, <=1.0.2) +43 more potentially affected by CVE-2026-42404 via org.apache.neethi:neethi (2.0.2)

org.apache.neethi:neethi MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.neethi:neethi and may be impacted: - com.apigee.edge.config:apigee-config-maven-plugin =1.0, =1.0.0-beta, =1.0.0, =1.0.0, =2.5.2 -...

com.apigee.edge.config:apigee-config-maven-plugin (>=1.0, <=2.9.3), com.apigee.registry.config:apigee-registry-maven-plugin (>=1.0.0-beta, <=1.0.2) +43 more potentially affected by CVE-2026-42403 via org.apache.neethi:neethi (2.0.2)

org.apache.neethi:neethi MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.neethi:neethi and may be impacted: - com.apigee.edge.config:apigee-config-maven-plugin =1.0, =1.0.0-beta, =1.0.0, =1.0.0, =2.5.2 -...

org.acegisecurity:acegi-security-samples-contacts (1.0.7), org.andromda.andromdapp.projects:andromda-andromdapp-project-richclient-ant (3.3) +1 more potentially affected by CVE-2026-22745 via org.springframework:spring-webmvc (1.2.9)

org.springframework:spring-webmvc MAVEN version 1.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.acegisecurity:acegi-security-samples-contacts 1.0.7 -...

com.exadel.flamingo.maven.plugin:flamingoapp (>=1.0.0, <=1.5.0), org.acegisecurity:acegi-security (>=1.0.1, <=1.0.2) +19 more potentially affected by CVE-2026-22745 via org.springframework:spring-webmvc (1.2.7)

org.springframework:spring-webmvc MAVEN version 1.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.exadel.flamingo.maven.plugin:flamingoapp =1.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1,...

This Week in Spring - April 28th, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring! As I write this, I'm on PTO in beautiful Santorini, Greece, catching up on some news and about to cruise the islands for some sightseeing. There's nothing quite like springtime in the Mediterranean! I couldn't dream of enjoyin...

com.github.linyuzai:concept-plugin-spring-boot-starter (>=2.0.0, <=3.0.0), de.gematik.test.tiger:tiger-on-fhir (>=1.1.1, <=1.2.1) +6 more potentially affected by CVE-2026-42037 via org.webjars.npm:axios (>=1.4.0, <=1.7.2)

org.webjars.npm:axios MAVEN version =1.4.0, =2.0.0, =1.1.1, =2.1.1, =2.1.1, =2.1.1, =2.1.3, =2.1.1, =1.0.6, =1.0.9 Source cves: CVE-2026-42037 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16299820...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.2.3) +5 more potentially affected by CVE-2026-41043 via org.apache.activemq:activemq-all (>=6.0.0, <=6.2.3)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.3 Source cves: CVE-2026-41043 Source advisory: OSV:GHSA-2JP3-2923-9H52...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.2.3) +5 more potentially affected by CVE-2026-40466 via org.apache.activemq:activemq-all (>=6.0.0, <=6.2.3)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.3 Source cves: CVE-2026-40466 Source advisory: MEND:CVE-2026-40466...