org.cibseven.bpm.springboot:cibseven-bpm-spring-boot-starter-security (2.2.0), org.cibseven.bpm.springboot:cibseven-bpm-spring-boot-starter-security-4 (2.2.0) +4 more potentially affected by CVE-2026-61700 via org.mariadb.jdbc:mariadb-java-client (1.7.6)

org.mariadb.jdbc:mariadb-java-client MAVEN version 1.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.mariadb.jdbc:mariadb-java-client and may be impacted: - org.cibseven.bpm.springboot:cibseven-bpm-spring-boot-starter-security 2.2.0 -...

org.cibseven.bpm.springboot:cibseven-bpm-spring-boot-starter-security (2.2.0), org.cibseven.bpm.springboot:cibseven-bpm-spring-boot-starter-security-4 (2.2.0) +4 more potentially affected by CVE-2026-55857 via org.mariadb.jdbc:mariadb-java-client (1.7.6)

org.mariadb.jdbc:mariadb-java-client MAVEN version 1.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.mariadb.jdbc:mariadb-java-client and may be impacted: - org.cibseven.bpm.springboot:cibseven-bpm-spring-boot-starter-security 2.2.0 -...

com.erudika:para-server (>=1.52.0, <=1.54.7), io.orqueio.bpm.springboot:orqueio-bpm-spring-boot-starter-security (>=2.0.1, <=2.0.7) +3 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=7.0.0, <=7.0.5)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =7.0.0, =1.52.0, =2.0.1, =4.0.0, =4.0.0, =4.0.0, =4.0.6 Source cves: CVE-2026-40988 Source advisory: GHSA-M69X-PW9P-7J3Q...

com.erudika:para-server (>=1.52.0, <=1.54.7), io.orqueio.bpm.springboot:orqueio-bpm-spring-boot-starter-security (>=2.0.1, <=2.0.7) +3 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=7.0.0, <=7.0.5)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =7.0.0, =1.52.0, =2.0.1, =4.0.0, =4.0.0, =4.0.0, =4.0.6 Source cves: CVE-2026-41694 Source advisory: OSV:GHSA-WW38-37G9-M3Q3...

am.ik.servicebroker:cloud-karafka-service-broker (>=0.0.2, <=0.0.3), cn.antcore:spring-boot-starter-security (1.0.0) +203 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (8.5.28)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.28 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - am.ik.servicebroker:cloud-karafka-service-broker =0.0.2, =0.1.0, =1.2.0,...

Memory corruption

In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring MVC Spring Security 6.1....