org.webjars.npm:rrweb (1.0.7), org.webjars.npm:rrweb-player (0.7.9) potentially affected by CVE-2025-45806 via org.webjars.npm:rrweb-snapshot (1.1.10)

org.webjars.npm:rrweb-snapshot MAVEN version 1.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:rrweb-snapshot and may be impacted: - org.webjars.npm:rrweb 1.0.7 - org.webjars.npm:rrweb-player 0.7.9 Source cves: CVE-2025-45806 Sourc...

tech.powerjob:powerjob-server-starter (>=4.3.1, <=5.1.1) potentially affected by CVE-2026-5739 via tech.powerjob:powerjob-server-core (>=4.3.1, <=5.1.1)

tech.powerjob:powerjob-server-core MAVEN version =4.3.1, =4.3.1, =5.1.1 Source cves: CVE-2026-5739 Source advisory: SNYK:JAVA-TECHPOWERJOB-15928844...

org.webjars.npm:vitepress (1.0.0-draft.8) potentially affected by CVE-2026-39365 via org.webjars.npm:vite (3.0.0-beta.9)

org.webjars.npm:vite MAVEN version 3.0.0-beta.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:vite and may be impacted: - org.webjars.npm:vitepress 1.0.0-draft.8 Source cves: CVE-2026-39365 Source advisory:...

org.webjars.npm:vitepress (1.0.0-draft.8) potentially affected by CVE-2026-39363 via org.webjars.npm:vite (3.0.0-beta.9)

org.webjars.npm:vite MAVEN version 3.0.0-beta.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:vite and may be impacted: - org.webjars.npm:vitepress 1.0.0-draft.8 Source cves: CVE-2026-39363 Source advisory:...

org.webjars.npm:autolinker (>=0.24.1, <=0.28.1), org.webjars.npm:github-com-mattslocum-ng-webworker (0.2.3) +10 more potentially affected by CVE-2021-23337 +1 more via org.webjars.npm:lodash.template (4.5.0)

org.webjars.npm:lodash.template MAVEN version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:lodash.template and may be impacted: - org.webjars.npm:autolinker =0.24.1, =2.9.0, =1.8.12, =3.5.0, =2.3.4, =2.5.17-beta.0 -...

org.webjars.npm:compression-webpack-plugin (7.1.1), org.webjars.npm:copy-webpack-plugin (>=4.3.1, <=4.6.0) +9 more potentially affected by CVE-2026-34043 via org.webjars.npm:serialize-javascript (>=1.9.1, <=6.0.2)

org.webjars.npm:serialize-javascript MAVEN version =1.9.1, =4.3.1, =5.2.0, =1.1.6, =2.3.4, =2.5.17-beta.0 Source cves: CVE-2026-34043 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15809197...

org.webjars.npm:github-com-cisco-node-jose (2.2.0), org.webjars.npm:google-auth-library (>=1.6.1, <=6.1.6) +7 more potentially affected by CVE-2026-33896 via org.webjars.npm:node-forge (>=0.7.1, <=1.3.3)

org.webjars.npm:node-forge MAVEN version =0.7.1, =1.6.1, =1.0.2, =2.3.2, =1.10.2, =2.1.1 Source cves: CVE-2026-33896 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15789772...

org.webjars.npm:github-com-cisco-node-jose (2.2.0), org.webjars.npm:google-auth-library (>=1.6.1, <=6.1.6) +7 more potentially affected by CVE-2026-33895 via org.webjars.npm:node-forge (>=0.7.1, <=1.3.3)

org.webjars.npm:node-forge MAVEN version =0.7.1, =1.6.1, =1.0.2, =2.3.2, =1.10.2, =2.1.1 Source cves: CVE-2026-33895 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15789768...

org.webjars.npm:github-com-cisco-node-jose (2.2.0), org.webjars.npm:google-auth-library (>=1.6.1, <=6.1.6) +7 more potentially affected by CVE-2026-33894 via org.webjars.npm:node-forge (>=0.7.1, <=1.3.3)

org.webjars.npm:node-forge MAVEN version =0.7.1, =1.6.1, =1.0.2, =2.3.2, =1.10.2, =2.1.1 Source cves: CVE-2026-33894 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15789774...

org.webjars.npm:github-com-cisco-node-jose (2.2.0), org.webjars.npm:google-auth-library (>=1.6.1, <=6.1.6) +7 more potentially affected by CVE-2026-33891 via org.webjars.npm:node-forge (>=0.7.1, <=1.3.3)

org.webjars.npm:node-forge MAVEN version =0.7.1, =1.6.1, =1.0.2, =2.3.2, =1.10.2, =2.1.1 Source cves: CVE-2026-33891 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15789770...

com.codbex.aion:codbex-aion-platform (>=0.5.6, <=0.5.7), com.codbex.aion:codbex-aion-platform-keycloack (>=0.5.6, <=0.5.7) +95 more potentially affected by CVE-2026-4923 via org.webjars.npm:path-to-regexp (>=0.1.7, <=8.4.2)

org.webjars.npm:path-to-regexp MAVEN version =0.1.7, =0.5.6, =0.5.6, =0.5.6, =0.4.0, =0.4.0, =0.5.3, =0.5.5 - com.codbex.kronos:codbex-kronos-coverage-aggregate 0.4.0 - com.codbex.kronos:codbex-kronos-modules-all 0.4.0 - com.codbex.kronos:codbex-kronos-modules-engines-all 0.4.0 -...

Software Supply Chain Smells: Lightweight Analysis for Secure Dependency Management

Modern software systems heavily rely on third-party dependencies, making software supply chain security a critical concern. We introduce the concept of software supply chain smells as structural indicators that signal potential security risks. We design and evaluate Dirty-Waters, a novel tool for...

org.scala-sbt:sbt (>=0.99.2, <=1.0.0-m4), org.scala-sbt:scripted-plugin_2.10 (>=0.99.2, <=1.0.0-m4) +1 more potentially affected by CVE-2026-32948 via org.scala-sbt:main_2.11 (>=0.99.2, <=1.0.0-m4)

org.scala-sbt:main2.11 MAVEN version =0.99.2, =0.99.2, =0.99.2, =0.99.2, =1.0.0-m4 Source cves: CVE-2026-32948 Source advisory: SNYK:JAVA-ORGSCALASBT-15763414...

acegisecurity:acegi-security (0.7.0), acegisecurity:acegi-security-cas (0.7.0) +4 more potentially affected by CVE-2026-22737 via springframework:spring-webmvc (>=1.1.3, <=1.2.1)

springframework:spring-webmvc MAVEN version =1.1.3, =1.0-rc2, =1.0-rc3 Source cves: CVE-2026-22737 Source advisory: SNYK:JAVA-SPRINGFRAMEWORK-15701846...

com.codbex.atlas:codbex-atlas-application (>=2.62.0, <=2.126.0), com.codbex.gaia:codbex-gaia-application (>=2.61.0, <=2.111.0) +25 more potentially affected by CVE-2026-33349 via org.webjars.npm:fast-xml-parser (>=4.5.3, <=5.8.0)

org.webjars.npm:fast-xml-parser MAVEN version =4.5.3, =2.62.0, =2.61.0, =2.52.0, =2.52.0, =2.51.0, =2.51.0, =3.6.0, =2.50.0, =5.0.0, =5.0.0, =11.58.0, =12.2.0, =11.58.0, =11.58.0, =14.19.0, =14.40.0 and more Source cves: CVE-2026-33349 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15699648...

org.webjars.npm:file-entry-cache (>=5.0.1, <=6.0.1), org.webjars.npm:flat-cache (>=2.0.1, <=3.0.4) +6 more potentially affected by CVE-2026-33228 via org.webjars.npm:flatted (>=2.0.1, <=3.3.4)

org.webjars.npm:flatted MAVEN version =2.0.1, =5.0.1, =2.0.1, =3.3.1, =0.3.16, =0.2.107, =1.1.13, =0.1.30, =1.7.6, =2.0.2 Source cves: CVE-2026-33228 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15700434...

acegisecurity:acegi-security (0.7.0), acegisecurity:acegi-security-cas (0.7.0) +4 more potentially affected by CVE-2026-22735 via springframework:spring-webmvc (>=1.1.3, <=1.2.1)

springframework:spring-webmvc MAVEN version =1.1.3, =1.0-rc2, =1.0-rc3 Source cves: CVE-2026-22735 Source advisory: SNYK:JAVA-SPRINGFRAMEWORK-15701757...

CVE-2026-32735

openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5.5.1, the parent POM file of this project openapi-to-java-records-mustache-templates-parent, which is used to centralize plugin...

CVE-2026-32735 Unpacking Arbitrary Mustache Template Files via `maven-dependency-plugin`

openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5.5.1, the parent POM file of this project openapi-to-java-records-mustache-templates-parent, which is used to centralize plugin...

CVE-2026-32735 Unpacking Arbitrary Mustache Template Files via `maven-dependency-plugin`

openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5.5.1, the parent POM file of this project openapi-to-java-records-mustache-templates-parent, which is used to centralize plugin...