org.springframework.amqp:spring-rabbit-test (>=4.0.0-m1, <=4.0.4), org.springframework.boot:spring-boot-starter-amqp-test (>=4.0.0-rc2, <=4.0.7) potentially affected by CVE-2026-59271 via org.springframework.amqp:spring-rabbit-junit (>=4.0.0-m1, <=4.0.4)

org.springframework.amqp:spring-rabbit-junit MAVEN version =4.0.0-m1, =4.0.0-m1, =4.0.0-rc2, =4.0.7 Source cves: CVE-2026-59271 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-19267402...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +3163 more potentially affected by CVE-2026-47890 via org.springframework:spring-webflux (>=6.2.0, <=7.0.8)

org.springframework:spring-webflux MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2026-47890 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267095...

ai.astraform:remote-domain-conformance-java (0.2.0), ai.astraform:remote-domain-template-java-spring (0.2.0) +4021 more potentially affected by CVE-2026-47887 via org.springframework:spring-webmvc (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-47887 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267099...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +10009 more potentially affected by CVE-2026-47888 via org.springframework:spring-messaging (>=5.2.0.release, <=7.0.8)

org.springframework:spring-messaging MAVEN version =5.2.0.release, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.0.1, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.9.2 and more Source cves: CVE-2026-47888 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267440https://vulners.com/snyk...

com.bushidowallet:bushido-address-watcher (>=1.0.0, <=1.0.1), com.bushidowallet:bushido-wallet-service (>=1.0.0, <=1.0.1) +11 more potentially affected by CVE-2026-61634 via com.rabbitmq:amqp-client (3.3.4)

com.rabbitmq:amqp-client MAVEN version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.bushidowallet:bushido-address-watcher =1.0.0, =1.0.0, =0.10.0, =3.0.0, =2.14.0, =2.2.0, =5.0.3,...

cn.springcloud.gray:spring-cloud-gray-plugin-event-stream (>=a.1.1.1, <=a.2.0.0), cn.springcloud.gray:spring-cloud-gray-server-plugin-event-stream (>=a.1.1.1, <=a.2.0.0) +15 more potentially affected by CVE-2026-63335 via com.rabbitmq:amqp-client (4.8.3)

com.rabbitmq:amqp-client MAVEN version 4.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - cn.springcloud.gray:spring-cloud-gray-plugin-event-stream =a.1.1.1, =a.1.1.1, =1.11.0, =1.3.7-2, =1.19.1,...

cn.springcloud.gray:spring-cloud-gray-plugin-event-stream (>=a.1.1.1, <=a.2.0.0), cn.springcloud.gray:spring-cloud-gray-server-plugin-event-stream (>=a.1.1.1, <=a.2.0.0) +15 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (4.8.3)

com.rabbitmq:amqp-client MAVEN version 4.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - cn.springcloud.gray:spring-cloud-gray-plugin-event-stream =a.1.1.1, =a.1.1.1, =1.11.0, =1.3.7-2, =1.19.1,...

com.bushidowallet:bushido-address-watcher (>=1.0.0, <=1.0.1), com.bushidowallet:bushido-wallet-service (>=1.0.0, <=1.0.1) +11 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (3.3.4)

com.rabbitmq:amqp-client MAVEN version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.bushidowallet:bushido-address-watcher =1.0.0, =1.0.0, =0.10.0, =3.0.0, =2.14.0, =2.2.0, =5.0.3,...

com.rabbitmq.jms:rabbitmq-jms (1.10.0), com.smoketurner.dropwizard:zipkin-core (1.3.7-1) +8 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (4.8.1)

com.rabbitmq:amqp-client MAVEN version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.rabbitmq.jms:rabbitmq-jms 1.10.0 - com.smoketurner.dropwizard:zipkin-core 1.3.7-1 -...

app.cash.trifle:common (>=0.2.9, <=0.2.10), app.cash.trifle:jvm (>=0.1.0, <=0.2.10) +1030 more potentially affected by CVE-2026-59639 via org.bouncycastle:bcpkix-jdk15to18 (>=1.63, <=1.84)

org.bouncycastle:bcpkix-jdk15to18 MAVEN version =1.63, =0.2.9, =0.1.0, =0.2.1, =0.2.0, =1.0.0, =1.0.1-rc14, =0.2.0, =0.2.0, =3.5.0.0, =2.6.4, =2.6.4, =2.6.4, =2.6.4, =2.6.4, =3.0.8 and more Source cves: CVE-2026-59639 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18513022...

CVE-2026-59328 Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...

com.github.linyuzai:concept-plugin-spring-boot-starter (>=2.0.0, <=3.0.0) potentially affected by CVE-2026-67317 via org.webjars.npm:axios (1.7.2)

org.webjars.npm:axios MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:axios and may be impacted: - com.github.linyuzai:concept-plugin-spring-boot-starter =2.0.0, =3.0.0 Source cves: CVE-2026-67317 Source advisory:...

com.github.linyuzai:concept-plugin-spring-boot-starter (>=2.0.0, <=3.0.0), org.webjars.npm:github-com-showdownjs-ng-showdown (1.1.0) +3 more potentially affected by CVE-2026-59710 via org.webjars.npm:showdown (>=1.9.1, <=2.1.0)

org.webjars.npm:showdown MAVEN version =1.9.1, =2.0.0, =1.0.2, =1.0.3 - org.webjars.npm:showdown-prism 0.2.0 Source cves: CVE-2026-59710 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17874451...

com.github.linyuzai:concept-plugin-spring-boot-starter (>=2.0.0, <=3.0.0), org.webjars.npm:github-com-showdownjs-ng-showdown (1.1.0) +3 more potentially affected by CVE-2026-59711 via org.webjars.npm:showdown (>=1.9.1, <=2.1.0)

org.webjars.npm:showdown MAVEN version =1.9.1, =2.0.0, =1.0.2, =1.0.3 - org.webjars.npm:showdown-prism 0.2.0 Source cves: CVE-2026-59711 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17874449...

com.github.jknack:handlebars-guava-cache (2.3.1), com.github.jknack:handlebars-helpers (2.3.1) +8 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (2.3.1)

com.github.jknack:handlebars MAVEN version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 2.3.1 - com.github.jknack:handlebars-helpers 2.3.1 -...

com.diboot:diboot-file-spring-boot-starter (2.6.0), com.diboot:diboot-iam-spring-boot-starter (2.6.0) +155 more potentially affected by CVE-2026-49268 via org.apache.shiro:shiro-core (1.9.0)

org.apache.shiro:shiro-core MAVEN version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - com.diboot:diboot-file-spring-boot-starter 2.6.0 - com.diboot:diboot-iam-spring-boot-starter 2.6.0 -...

com.github.arucard21.simplyrestful:deploy-jetty-cxf (>=0.17.4, <=0.18.2), com.github.arucard21.simplyrestful:deploy-springboot-cxf (>=0.17.4, <=0.18.2) +353 more potentially affected by CVE-2026-49875 via org.apache.cxf:cxf-core (3.4.4)

org.apache.cxf:cxf-core MAVEN version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-core and may be impacted: - com.github.arucard21.simplyrestful:deploy-jetty-cxf =0.17.4, =0.17.4, =4.9.2, =4.9.2, =4.0.0-beta.1, =4.1.0 -...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.114.0, <=0.120.0) +8970 more potentially affected by CVE-2026-41001 via org.springframework.boot:spring-boot-autoconfigure (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.4.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.29 and more Source cves: CVE-2026-41001 Source advisory: OSV:GHSA-GGG2-9786-HWC8...

org.springframework.boot:spring-boot-starter-integration (1.3.6.release), org.springframework.integration:spring-integration-ftp (4.2.8.release) +1 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.2.8.release)

org.springframework.integration:spring-integration-file MAVEN version 4.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

com.mozu:mozu-api-jobs (>=1.0.13, <=1.0.23), gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin (>=0.0.1, <=0.0.8) +5 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (3.0.2.release)

org.springframework.integration:spring-integration-file MAVEN version 3.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.mozu:mozu-api-jobs =1.0.13, =0.0.1,...