no.skatteetaten.aurora.springboot:aurora-spring-boot-starter (3.6.0), org.apache.skywalking:apache-skywalking-apm (>=6.1.0, <=6.4.0) +3 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.11.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - no.skatteetaten.aurora.springboot:aurora-spring-boot-starter...

com.foreach.across.modules:dynamic-forms-module (0.0.2.release), no.skatteetaten.aurora.springboot:aurora-spring-boot-starter (3.7.4) +1 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.17.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.foreach.across.modules:dynamic-forms-module 0.0.2.releas...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=1.0.12, <=2.0.5), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=1.0.12, <=2.0.5) +6 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.10.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (0.0.15), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (0.0.15) +67 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.5.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=0.0.8, <=0.0.9), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=0.0.8, <=0.0.9) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.2.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=0.0.10, <=0.0.14), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=0.0.10, <=0.0.14) +10 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.3.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (1.0.4), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (1.0.4) +4 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.4.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.avioconsulting.maven:ics-maven-plugin (1.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=0.0.2, <=0.0.5) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.0.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.avioconsulting.maven:ics-maven-plugin 1.0 -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=1.0.10, <=2.0.4), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=1.0.10, <=2.0.4) +223 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.7.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

io.crossplane.compositefunctions:crossplane-function-example (>=1.20-alpha, <=2.1.0), io.crossplane.compositefunctions:crossplane-function-springboot-starter (>=1.20-alpha, <=2.1.0) +19 more potentially affected by CVE-2026-40969 via org.springframework.grpc:spring-grpc-core (>=1.0.0-rc1, <=1.0.2)

org.springframework.grpc:spring-grpc-core MAVEN version =1.0.0-rc1, =1.20-alpha, =1.20-alpha, =2026.01, =0.8.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0.0, =1.0.0-rc1, =1.0.2 - org.springfr...

io.crossplane.compositefunctions:crossplane-function-example (>=1.20-alpha, <=2.1.0), io.crossplane.compositefunctions:crossplane-function-springboot-starter (>=1.20-alpha, <=2.1.0) +19 more potentially affected by CVE-2026-40968 via org.springframework.grpc:spring-grpc-core (>=1.0.0-rc1, <=1.0.2)

org.springframework.grpc:spring-grpc-core MAVEN version =1.0.0-rc1, =1.20-alpha, =1.20-alpha, =2026.01, =0.8.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0.0, =1.0.0-rc1, =1.0.2 - org.springfr...

org.apache.camel.kafkaconnector:camel-mina-kafka-connector (>=0.1.0, <=0.11.5), org.apache.camel.karaf:camel-mina (>=4.7.0, <=4.14.5) +6 more potentially affected by CVE-2026-40473 via org.apache.camel:camel-mina (>=3.0.0, <=4.14.5)

org.apache.camel:camel-mina MAVEN version =3.0.0, =0.1.0, =4.7.0, =3.0.0, =4.0.0, =4.0.0, =4.0.0, =4.3.2 Source cves: CVE-2026-40473 Source advisory: GHSA-VPR3-2659-RW55...

org.apache.camel.kafkaconnector:camel-mina-kafka-connector (>=0.1.0, <=0.11.5), org.apache.camel.karaf:camel-mina (>=4.7.0, <=4.14.5) +6 more potentially affected by CVE-2026-40473 via org.apache.camel:camel-mina (>=3.0.0, <=4.14.5)

org.apache.camel:camel-mina MAVEN version =3.0.0, =0.1.0, =4.7.0, =3.0.0, =4.0.0, =4.0.0, =4.0.0, =4.3.2 Source cves: CVE-2026-40473 Source advisory: MEND:CVE-2026-40473...

io.github.vishalmysore:easyqserver (>=0.2.8.11.1, <=0.2.8.12.3), org.springframework.ai:spring-ai-mongodb-atlas-store-spring-boot-starter (>=1.0.0-m5, <=1.0.0-m6) +1 more potentially affected by CVE-2026-40967 via org.springframework.ai:spring-ai-mongodb-atlas-store (>=1.0.0-m5, <=1.0.5)

org.springframework.ai:spring-ai-mongodb-atlas-store MAVEN version =1.0.0-m5, =0.2.8.11.1, =1.0.0-m5, =1.0.0-m7, =1.0.5 Source cves: CVE-2026-40967 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-16321392...

org.springframework.ai:spring-ai-oracle-store-spring-boot-starter (>=1.0.0-m5, <=1.0.0-m6), org.springframework.ai:spring-ai-starter-vector-store-oracle (>=1.0.0-m7, <=1.0.5) potentially affected by CVE-2026-40967 via org.springframework.ai:spring-ai-oracle-store (>=1.0.0-m5, <=1.0.5)

org.springframework.ai:spring-ai-oracle-store MAVEN version =1.0.0-m5, =1.0.0-m5, =1.0.0-m7, =1.0.5 Source cves: CVE-2026-40967 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-16321393...

org.springframework.ai:spring-ai-starter-vector-store-typesense (>=1.0.0-m7, <=1.0.5), org.springframework.ai:spring-ai-typesense-store-spring-boot-starter (>=1.0.0-m5, <=1.0.0-m6) potentially affected by CVE-2026-40967 via org.springframework.ai:spring-ai-typesense-store (>=1.0.0-m5, <=1.0.5)

org.springframework.ai:spring-ai-typesense-store MAVEN version =1.0.0-m5, =1.0.0-m7, =1.0.0-m5, =1.0.0-m6 Source cves: CVE-2026-40967 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-16321396...

org.springframework.ai:spring-ai-gemfire-store-spring-boot-starter (>=1.0.0-m5, <=1.0.0-m6), org.springframework.ai:spring-ai-starter-vector-store-gemfire (>=1.0.0-m7, <=1.0.5) potentially affected by CVE-2026-40967 via org.springframework.ai:spring-ai-gemfire-store (>=1.0.0-m5, <=1.0.5)

org.springframework.ai:spring-ai-gemfire-store MAVEN version =1.0.0-m5, =1.0.0-m5, =1.0.0-m7, =1.0.5 Source cves: CVE-2026-40967 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-16321389...

com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-admin (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-core (1.0.0.4) +4 more potentially affected by CVE-2026-40967 via org.springframework.ai:spring-ai-elasticsearch-store (>=1.0.0-m5, <=1.0.5)

org.springframework.ai:spring-ai-elasticsearch-store MAVEN version =1.0.0-m5, =4.2.3, =1.0.0-m5, =1.0.0-m7, =1.0.5 Source cves: CVE-2026-40967 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-16321388...

org.springframework.ai:spring-ai-mariadb-store-spring-boot-starter (>=1.0.0-m5, <=1.0.0-m6), org.springframework.ai:spring-ai-starter-vector-store-mariadb (>=1.0.0-m7, <=1.0.5) potentially affected by CVE-2026-40967 via org.springframework.ai:spring-ai-mariadb-store (>=1.0.0-m5, <=1.0.5)

org.springframework.ai:spring-ai-mariadb-store MAVEN version =1.0.0-m5, =1.0.0-m5, =1.0.0-m7, =1.0.5 Source cves: CVE-2026-40967 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-16321390...

org.springframework.ai:spring-ai-starter-vector-store-weaviate (>=1.0.0-m7, <=1.0.5), org.springframework.ai:spring-ai-weaviate-store-spring-boot-starter (>=1.0.0-m5, <=1.0.0-m6) potentially affected by CVE-2026-40967 via org.springframework.ai:spring-ai-weaviate-store (>=1.0.0-m5, <=1.0.5)

org.springframework.ai:spring-ai-weaviate-store MAVEN version =1.0.0-m5, =1.0.0-m7, =1.0.0-m5, =1.0.0-m6 Source cves: CVE-2026-40967 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-16321397...