ROOT-APP-MAVEN-CVE-2023-20883 CVE-2023-20883 in org.springframework.boot:spring-boot-autoconfigure - Patched by Root

Root has patched CVE-2023-20883 in the org.springframework.boot:spring-boot-autoconfigure package for Root:Maven. Multiple fixed versions available...

Security Bulletin: Vulnerability in Spring Boot affects DB2 Dev Extension (CVE-2026-40992, CVE-2026-41001)

Summary Upgraded spring-boot-autoconfigure to 3.5.15 to remediate CVE-2026-40992 Improper Certificate Validation and CVE-2026-41001 Insecure Temporary File — highest CVSS Base Score 5.3 Medium — PVR0789890. Vulnerability Details CVEID:CVE-2026-40992 DESCRIPTION: Spring Boot's Mail...

ai.astraform:remote-domain-conformance-java (0.2.0), ai.astraform:remote-domain-template-java-spring (0.2.0) +4006 more potentially affected by CVE-2026-47887 via org.springframework:spring-webmvc (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-47887 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267099...

ROOT-APP-MAVEN-CVE-2026-40992 CVE-2026-40992 in io.root.org.springframework.boot:spring-boot-autoconfigure - Patched by Root

Root has patched CVE-2026-40992 in the io.root.org.springframework.boot:spring-boot-autoconfigure package for Root:Maven. Multiple fixed versions available...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.114.0, <=0.120.0) +8959 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.4.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.29 and more Source cves: CVE-2026-41001 Source advisory: GHSA-GGG2-9786-HWC8...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (0.28.0) +8373 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.3.0, <=3.3.13)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.3.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41001 Source advisory: OSV:GHSA-GGG2-9786-HWC8...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10768 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.5.0, <=3.5.14)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.5.0, =0.1.0, =0.1.0, =1.0.0-beta, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.8.4 and more Source cves: CVE-2026-41001 Source advisory: GHSA-GGG2-9786-HWC8...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (0.28.0) +8373 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.3.0, <=3.3.13)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.3.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41001 Source advisory: GHSA-GGG2-9786-HWC8...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10768 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.5.0, <=3.5.14)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.5.0, =0.1.0, =0.1.0, =1.0.0-beta, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.8.4 and more Source cves: CVE-2026-41001 Source advisory: OSV:GHSA-GGG2-9786-HWC8...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.114.0, <=0.120.0) +8959 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.4.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.29 and more Source cves: CVE-2026-41001 Source advisory: OSV:GHSA-GGG2-9786-HWC8...

ai.apiverse:apipulse (1.0.1), ai.chat2db.excel:easyexcel-plus-test (0.0.1) +13604 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=2.7.0, <=2.7.18)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =2.7.0, =0.18, =0.18, =0.18, =0.18, =0.18, =0.18, =0.18, =1.0, =0.8.38, =0.8.38, =v0.16.1, =v0.16.1, =v0.16.1, =v0.123.652 and more Source cves: CVE-2026-41001 Source advisory: OSV:GHSA-GGG2-9786-HWC8...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10768 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.5.0, <=3.5.14)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.5.0, =0.1.0, =0.1.0, =1.0.0-beta, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.8.4 and more Source cves: CVE-2026-41001 Source advisory: MEND:CVE-2026-41001...

ai.platon.pulsar:browser4-boot (>=4.13.5, <=4.14.0-rc.2), ai.platon.pulsar:browser4-captcha (>=4.13.5, <=4.14.0-rc.2) +6680 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=4.0.0, <=4.0.6)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =4.0.0, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-41001 Source advisory: MEND:CVE-2026-41001...

biz.jovido:jovido-webseed (>=0.0.1, <=0.0.1-fenicesfa), biz.jovido:jovido-webseed-fenicesfa (0.0.1) +368 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.4.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - biz.jovido:jovido-webseed =0.0.1, =1.0.2, =1.0.2, =a.1.0.0,...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch via missing hostname verification in the auto-configuration. An attacker can impersonate a trusted mail server and intercept or manipulate SMTP communications because hostname...

ai.platon.pulsar:browser4-boot (>=4.13.5, <=4.14.0-rc.2), ai.platon.pulsar:browser4-captcha (>=4.13.5, <=4.14.0-rc.2) +6732 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=4.0.0-m1, <=4.0.6)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =4.0.0-m1, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-41001 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKBOOT-17308346...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +14765 more potentially affected by CVE-2026-40992 via org.springframework.boot:spring-boot-autoconfigure (>=3.4.0, <=3.5.14)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.4.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2026-40992 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKBOOT-17304741...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +24846 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.0.0, <=3.5.14)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.0.0, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 - ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo 0.1.0 -...

ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0, <=0.3.0) +759 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=4.1.0-m1, <=4.1.0-rc1)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =4.1.0-m1, =0.1.0, =0.1.0, =1.0.0-m1, =1.0.0-m1, =1.10.9, =1.10.9, =1.0.0, =1.0.2 - com.vaadin:copilot 25.2.0-beta1 - com.vaadin:hilla-endpoint 25.2.0-beta1 - com.vaadin:hilla-spring-boot-starter 25.2.0-beta1 -...

Insecure Temporary File

Overview Affected versions of this package are vulnerable to Insecure Temporary File via the default data directory configuration in ArtemisEmbeddedConfigurationFactory. A local attacker can tamper with or redirect the embedded Artemis broker's data storage by pre-creating the predictable data...