ROOT-APP-MAVEN-CVE-2024-52316 CVE-2024-52316 in io.root.org.apache.tomcat:tomcat-catalina - Patched by Root

Root has patched CVE-2024-52316 in the io.root.org.apache.tomcat:tomcat-catalina package for Root:Maven. Multiple fixed versions available...

This Week in Spring - April 28th, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring! As I write this, I'm on PTO in beautiful Santorini, Greece, catching up on some news and about to cruise the islands for some sightseeing. There's nothing quite like springtime in the Mediterranean! I couldn't dream of enjoyin...

ai.ylyue:yue-library-data-log (j17.3.3.1), ai.ylyue:yue-library-data-mybatis (j17.3.3.1) +245 more potentially affected by CVE-2026-7045 via com.baomidou:dynamic-datasource-spring-boot-common (>=4.0.0, <=4.5.0)

com.baomidou:dynamic-datasource-spring-boot-common MAVEN version =4.0.0, =1.1.9, =1.1.9, =2024.1.1.0, =2023.5.1.0, =2022.5.0.0, =2022.4.1.0, =1.0.0-jdk21, =1.0.0-jdk21, =1.0.3.2-jdk21 - cn.osclass:osclass4-module-rdb 1.0.0 - cn.starlight-software:sherly-mybatis 2.0.6 and more Source cves:...

org.webjars.npm:adal-node (0.1.28), org.webjars.npm:canvg (>=1.5.2, <=1.5.3) +14 more potentially affected by CVE-2026-41674 via org.webjars.npm:xmldom (>=0.1.31, <=0.6.0)

org.webjars.npm:xmldom MAVEN version =0.1.31, =1.5.2, =0.7.2, =0.14.0, =0.11.0, =7.14.0, =2.7.0, =2.9.2 and more Source cves: CVE-2026-41674 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16134550...

org.webjars.npm:built-in-math-eval (0.3.0), org.webjars.npm:interval-arithmetic-eval (0.4.6) potentially affected by CVE-2026-41507 via org.webjars.npm:math-codegen (0.3.5)

org.webjars.npm:math-codegen MAVEN version 0.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:math-codegen and may be impacted: - org.webjars.npm:built-in-math-eval 0.3.0 - org.webjars.npm:interval-arithmetic-eval 0.4.6 Source cves:...

org.webjars.npm:adal-node (0.1.28), org.webjars.npm:canvg (>=1.5.2, <=1.5.3) +14 more potentially affected by CVE-2026-41672 via org.webjars.npm:xmldom (>=0.1.31, <=0.6.0)

org.webjars.npm:xmldom MAVEN version =0.1.31, =1.5.2, =0.7.2, =0.14.0, =0.11.0, =7.14.0, =2.7.0, =2.9.2 and more Source cves: CVE-2026-41672 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16133135...

org.webjars.npm:bazel__typescript (1.7.0), org.webjars.npm:cesium (>=1.96.0, <=1.144.0) +13 more potentially affected by CVE-2026-41242 via org.webjars.npm:protobufjs (>=6.8.8, <=8.7.2)

org.webjars.npm:protobufjs MAVEN version =6.8.8, =1.96.0, =1.0.0, =1.0.0, =10.13.0, =4.7.0, =0.3.35, =1.6.1, =0.5.2, =0.7.15 - org.webjars.npm:tiktok-live-connector 1.0.2 Source cves: CVE-2026-41242 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16094666...

dev.dsf:dsf-bpe-server-jetty (>=1.0.0-m1, <=1.9.0) potentially affected by CVE-2026-40939 via dev.dsf:dsf-bpe-server (>=1.0.0, <=1.9.0)

dev.dsf:dsf-bpe-server MAVEN version =1.0.0, =1.0.0-m1, =1.9.0 Source cves: CVE-2026-40939 Source advisory: SNYK:JAVA-DEVDSF-16540564...

dev.dsf:dsf-bpe-process-api-v1 (>=1.0.0-m1, <=1.9.0), dev.dsf:dsf-bpe-server (>=1.0.0-m1, <=1.9.0) +10 more potentially affected by CVE-2026-40939 via dev.dsf:dsf-common-auth (>=1.0.0, <=1.9.0)

dev.dsf:dsf-common-auth MAVEN version =1.0.0, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.2.0 Source cves: CVE-2026-40939 Source advisory: SNYK:JAVA-DEVDSF-16540566...

dev.dsf:dsf-bpe-server-jetty (>=1.0.0-m1, <=1.9.0), dev.dsf:dsf-fhir-server-jetty (>=1.0.0-m1, <=1.9.0) potentially affected by CVE-2026-40939 via dev.dsf:dsf-common-jetty (>=1.0.0, <=1.9.0)

dev.dsf:dsf-common-jetty MAVEN version =1.0.0, =1.0.0-m1, =1.0.0-m1, =1.9.0 Source cves: CVE-2026-40939 Source advisory: SNYK:JAVA-DEVDSF-16540565...

de.digitalcollections:iiif-bookshelf-webapp (>=2.6.2, <=3.1.0), de.digitalcollections:iiif-server-demo (>=2.1.3, <=4.0.6) +25 more potentially affected by CVE-2025-69993 via org.webjars.npm:leaflet (>=0.7.7, <=2.0.0-alpha.1)

org.webjars.npm:leaflet MAVEN version =0.7.7, =2.6.2, =2.1.3, =0.9.0, =1.0.3, =2.0.0 - org.webjars.npm:github-com-cliffcloud-leaflet-easybutton 2.3.0 - org.webjars.npm:github-com-colorlibhq-gentelella- 4.0.0-rc.1 - org.webjars.npm:github-com-commenthol-leaflet-rastercoords 1.0.2 -...

This Week in Spring - April 14th, 2026

Hi, Spring fans! ¡Hola from Barcelona, Spain! I'm at the amazing Spring I/O event, hanging out with some of the amazing Spring ecosystem developers! Life is amazing here in the warm sun of springtime. There's a lot to look at this week, so let's dive right into it! Another nice tutorial on how to...

org.webjars.npm:g-status (2.0.2), org.webjars.npm:graphql-toolkit__git-loader (0.7.5) potentially affected by CVE-2022-25860 +1 more via org.webjars.npm:simple-git (>=1.129.0, <=1.132.0)

org.webjars.npm:simple-git MAVEN version =1.129.0, =1.132.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:simple-git and may be impacted: - org.webjars.npm:g-status 2.0.2 - org.webjars.npm:graphql-toolkitgit-loader 0.7.5 Source cves:...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +25545 more potentially affected by CVE-2026-34479 via org.apache.logging.log4j:log4j-core (>=2.0, <=3.0.0-beta3)

org.apache.logging.log4j:log4j-core MAVEN version =2.0, =0.14.1, =0.1.0, =0.9.6, =0.12.0, =0.9.6, =0.9.6, =0.9.6, =0.9.6, =0.14.1, =0.9.6, =0.14.1, =4.4.0.0, =1.4.6, =1.4.6, =1.4.9 and more Source cves: CVE-2026-34479 Source advisory: SNYK:JAVA-ORGAPACHELOGGINGLOG4J-15967804...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +25545 more potentially affected by CVE-2026-34477 via org.apache.logging.log4j:log4j-core (>=2.0, <=3.0.0-beta3)

org.apache.logging.log4j:log4j-core MAVEN version =2.0, =0.14.1, =0.1.0, =0.9.6, =0.12.0, =0.9.6, =0.9.6, =0.9.6, =0.9.6, =0.14.1, =0.9.6, =0.14.1, =4.4.0.0, =1.4.6, =1.4.6, =1.4.9 and more Source cves: CVE-2026-34477 Source advisory: SNYK:JAVA-ORGAPACHELOGGINGLOG4J-15967727...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +25545 more potentially affected by CVE-2026-34478 via org.apache.logging.log4j:log4j-core (>=2.0, <=3.0.0-beta3)

org.apache.logging.log4j:log4j-core MAVEN version =2.0, =0.14.1, =0.1.0, =0.9.6, =0.12.0, =0.9.6, =0.9.6, =0.9.6, =0.9.6, =0.14.1, =0.9.6, =0.14.1, =4.4.0.0, =1.4.6, =1.4.6, =1.4.9 and more Source cves: CVE-2026-34478 Source advisory: SNYK:JAVA-ORGAPACHELOGGINGLOG4J-15967739...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +25545 more potentially affected by CVE-2026-34480 via org.apache.logging.log4j:log4j-core (>=2.0, <=3.0.0-beta3)

org.apache.logging.log4j:log4j-core MAVEN version =2.0, =0.14.1, =0.1.0, =0.9.6, =0.12.0, =0.9.6, =0.9.6, =0.9.6, =0.9.6, =0.14.1, =0.9.6, =0.14.1, =4.4.0.0, =1.4.6, =1.4.6, =1.4.9 and more Source cves: CVE-2026-34480 Source advisory: SNYK:JAVA-ORGAPACHELOGGINGLOG4J-15967769...

GHSA-HWQH-2684-54FC Spring Cloud Gateway's SSL bundle configuration silently bypassed

When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud...

Spring Cloud Gateway's SSL bundle configuration silently bypassed

When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud...

org.webjars.npm:unhead__vue (>=1.11.20, <=2.1.10), org.webjars.npm:vueuse__head (1.0.22) potentially affected by CVE-2026-39315 via org.webjars.npm:unhead (>=1.11.20, <=2.1.10)

org.webjars.npm:unhead MAVEN version =1.11.20, =1.11.20, =2.1.10 - org.webjars.npm:vueusehead 1.0.22 Source cves: CVE-2026-39315 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15965924...