com.github.vindell:spring-boot-starter-cxf-jaxws-plus (>=1.0.0.release, <=1.0.2.release), org.apache.cxf:apache-cxf (>=3.3.0, <=3.6.10) +1 more potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=3.2.4, <=3.6.10)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =3.2.4, =1.0.0.release, =3.3.0, =3.4.0, =3.6.10 Source cves: CVE-2026-44618 Source advisory: MEND:CVE-2026-44618...

com.ibeetl:beetl-online-web (3.15.3.release), com.ibeetl:beetl-spring-boot-starter-classic (>=3.14.1.release, <=3.20.2.release) potentially affected by CVE-2026-8759 via com.ibeetl:beetl-spring-classic (>=3.14.1.release, <=3.20.2.release)

com.ibeetl:beetl-spring-classic MAVEN version =3.14.1.release, =3.14.1.release, =3.20.2.release Source cves: CVE-2026-8759 Source advisory: OSV:GHSA-FMMW-44RP-JCFP...

com.ibeetl:beetl-online-web (3.15.3.release), com.ibeetl:beetl-spring-boot-starter-classic (>=3.14.1.release, <=3.20.2.release) potentially affected by CVE-2026-8759 via com.ibeetl:beetl-spring-classic (>=3.14.1.release, <=3.20.2.release)

com.ibeetl:beetl-spring-classic MAVEN version =3.14.1.release, =3.14.1.release, =3.20.2.release Source cves: CVE-2026-8759 Source advisory: GHSA-FMMW-44RP-JCFP...

am.ik.servicebroker:cloud-karafka-service-broker (>=0.0.2, <=0.0.3), cn.antcore:spring-boot-starter-security (1.0.0) +203 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (8.5.28)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.28 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - am.ik.servicebroker:cloud-karafka-service-broker =0.0.2, =0.1.0, =1.2.0,...

biz.jovido:jovido-webseed (>=0.0.1, <=0.0.1-fenicesfa), biz.jovido:jovido-webseed-fenicesfa (0.0.1) +220 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (8.5.15)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - biz.jovido:jovido-webseed =0.0.1, =1.0.1, =1.1.12, =1.1.12, =1.2.28, =1.1.2,...

io.github.davidalmeidac:sealed-env-spring-boot-starter (>=0.1.0-alpha.1, <=0.1.0-alpha.3) potentially affected by CVE-2026-45091 via io.github.davidalmeidac:sealed-env-core (>=0.1.0-alpha.1, <=0.1.0-alpha.3)

io.github.davidalmeidac:sealed-env-core MAVEN version =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3 Source cves: CVE-2026-45091 Source advisory: OSV:GHSA-X3R2-FJ3R-G5MV...

io.github.davidalmeidac:sealed-env-spring-boot-starter (>=0.1.0-alpha.1, <=0.1.0-alpha.3) potentially affected by CVE-2026-45091 via io.github.davidalmeidac:sealed-env-core (>=0.1.0-alpha.1, <=0.1.0-alpha.3)

io.github.davidalmeidac:sealed-env-core MAVEN version =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3 Source cves: CVE-2026-45091 Source advisory: GHSA-X3R2-FJ3R-G5MV...

io.github.davidalmeidac:sealed-env-spring-boot-starter (>=0.1.0-alpha.1, <=0.1.0-alpha.3) potentially affected by CVE-2026-45091 via io.github.davidalmeidac:sealed-env-core (>=0.1.0-alpha.1, <=0.1.0-alpha.3)

io.github.davidalmeidac:sealed-env-core MAVEN version =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3 Source cves: CVE-2026-45091 Source advisory: MEND:CVE-2026-45091...

org.springframework.ai:spring-ai-starter-vector-store-typesense (>=1.0.0-m7, <=1.0.6), org.springframework.ai:spring-ai-typesense-store-spring-boot-starter (>=1.0.0-m5, <=1.0.0-m6) potentially affected by CVE-2026-41705 via org.springframework.ai:spring-ai-typesense-store (>=1.0.0-m5, <=1.0.6)

org.springframework.ai:spring-ai-typesense-store MAVEN version =1.0.0-m5, =1.0.0-m7, =1.0.0-m5, =1.0.0-m6 Source cves: CVE-2026-41705 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-16624641...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.1.1, <=0.112.0) +1743 more potentially affected by CVE-2026-22740 via org.springframework:spring-webflux (>=6.1.0, <=6.1.21)

org.springframework:spring-webflux MAVEN version =6.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.6.0, =0.6.0, =0.5.0, =1.2.0, =1.1.0, =1.3.0 and more Source cves: CVE-2026-22740 Source advisory: GHSA-5843-P793-GHMM...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.1.1, <=0.112.0) +1743 more potentially affected by CVE-2026-22741 via org.springframework:spring-webflux (>=6.1.0, <=6.1.21)

org.springframework:spring-webflux MAVEN version =6.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.6.0, =0.6.0, =0.5.0, =1.2.0, =1.1.0, =1.3.0 and more Source cves: CVE-2026-22741 Source advisory: OSV:GHSA-WG35-8JPF-2XV3...

com.consol.citrus:citrus-http (2.2), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +78 more potentially affected by CVE-2026-22745 via org.springframework:spring-webmvc (4.0.7.release)

org.springframework:spring-webmvc MAVEN version 4.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.consol.citrus:citrus-http 2.2 - de.codecentric:jbehave-admin-server =0.0.1, =1.0....

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.ancf.lmos:lmos-operator (>=0.5.0, <=0.6.0) +7022 more potentially affected by CVE-2026-22741 via org.springframework:spring-webmvc (>=6.2.0, <=6.2.17)

org.springframework:spring-webmvc MAVEN version =6.2.0, =0.5.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =0.0.2, =0.0.2, =0.0.2, =0.8.4 and more Source cves: CVE-2026-22741 Source advisory: MEND:CVE-2026-22741...

com.devskiller.friendly-id:friendly-id-openfeign (>=2.0.0-alpha3, <=2.0.0-beta6), io.github.bluetape4k:bluetape4k-spring-boot4-cassandra (>=1.5.0-beta2, <=1.7.0) +19 more potentially affected by CVE-2026-40974 via org.springframework.boot:spring-boot-cassandra (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot-cassandra MAVEN version =4.0.0, =2.0.0-alpha3, =1.5.0-beta2, =0.8.0, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0...

com.devskiller.friendly-id:friendly-id-openfeign (>=2.0.0-alpha3, <=2.0.0-beta6), io.github.bluetape4k:bluetape4k-spring-boot4-cassandra (>=1.5.0-beta2, <=1.7.0) +19 more potentially affected by CVE-2026-40975 via org.springframework.boot:spring-boot-cassandra (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot-cassandra MAVEN version =4.0.0, =2.0.0-alpha3, =1.5.0-beta2, =0.8.0, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0...

com.devskiller.friendly-id:friendly-id-openfeign (>=2.0.0-alpha3, <=2.0.0-beta6), io.github.bluetape4k:bluetape4k-spring-boot4-cassandra (>=1.5.0-beta2, <=1.7.0) +19 more potentially affected by CVE-2026-40977 via org.springframework.boot:spring-boot-cassandra (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot-cassandra MAVEN version =4.0.0, =2.0.0-alpha3, =1.5.0-beta2, =0.8.0, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0...

org.springframework.boot:spring-boot-actuator (1.1.0.release), org.springframework.boot:spring-boot-autoconfigure (1.1.0.release) +29 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.1.0.release)

org.springframework.boot:spring-boot MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - org.springframework.boot:spring-boot-actuator 1.1.0.release -...

org.camunda.bpm.extension.example:camunda-bpm-spring-boot-starter-example-simple (1.2.1) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.6.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

no.skatteetaten.aurora.springboot:aurora-spring-boot-starter (>=3.7.2, <=3.7.3), org.springframework.boot:spring-boot-docs (1.5.15.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.15.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - no.skatteetaten.aurora.springboot:aurora-spring-boot-starter...

no.skatteetaten.aurora.springboot:aurora-spring-boot-starter (3.6.0), org.apache.skywalking:apache-skywalking-apm (>=6.1.0, <=6.4.0) +3 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.11.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - no.skatteetaten.aurora.springboot:aurora-spring-boot-starter...