com.oracle.database.spring.cloud-stream-binder:spring-cloud-stream-binder-oracle-txeventq (>=0.20.0, <=0.21.0), com.solace.connector.core.io:spring-cloud-stream-binder-jms (5.0.1) +2 more potentially affected by CVE-2026-47880 via org.springframework.integration:spring-integration-jms (7.1.0)

org.springframework.integration:spring-integration-jms MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-jms and may be impacted: -...

com.oracle.database.spring.cloud-stream-binder:spring-cloud-stream-binder-oracle-txeventq (>=0.17.0, <=0.19.0), org.springframework.cloud.fn:spring-jms-supplier (6.0.0) potentially affected by CVE-2026-47880 via org.springframework.integration:spring-integration-jms (>=7.0.2, <=7.0.4)

org.springframework.integration:spring-integration-jms MAVEN version =7.0.2, =0.17.0, =0.19.0 - org.springframework.cloud.fn:spring-jms-supplier 6.0.0 Source cves: CVE-2026-47880 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKINTEGRATION-19267412...

ch.sbb:spring-cloud-stream-binder-solace (>=9.1.0, <=9.3.0), cn.herodotus.dante:dante-authentication-autoconfigure (4.1.0.1) +522 more potentially affected by CVE-2026-47856 via org.springframework.integration:spring-integration-core (7.1.0)

org.springframework.integration:spring-integration-core MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-core and may be impacted: - ch.sbb:spring-cloud-stream-binder-solace =9.1.0,...

io.awspring.cloud:spring-cloud-aws-starter-integration-sns (>=4.0.0-m1, <=4.2.0), org.citrusframework.mvn:citrus-maven-plugin (5.0.0-m1) +34 more potentially affected by CVE-2026-47864 via org.springframework.integration:spring-integration-http (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-http MAVEN version =7.0.0-m1, =4.0.0-m1, =4.2.0 - org.citrusframework.mvn:citrus-maven-plugin 5.0.0-m1 - org.citrusframework:citrus-agent-connector 5.0.0-m1 - org.citrusframework:citrus-cucumber-all 5.0.0-m1 -...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3) +730 more potentially affected by CVE-2026-47856 via org.springframework.integration:spring-integration-core (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-core MAVEN version =7.0.0-m1, =8.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 -...

org.springframework.cloud.fn:spring-syslog-supplier (6.0.0), org.springframework.cloud.fn:spring-tcp-common (6.0.0) +7 more potentially affected by CVE-2026-47861 via org.springframework.integration:spring-integration-ip (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-ip MAVEN version =7.0.0-m1, =7.0.0-m1, =7.0.5 Source cves: CVE-2026-47861 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKINTEGRATION-19267411...

org.springframework.integration:spring-integration-groovy (7.1.0) potentially affected by CVE-2026-59321 via org.springframework.integration:spring-integration-scripting (7.1.0)

org.springframework.integration:spring-integration-scripting MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-scripting and may be impacted: -...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3) +730 more potentially affected by CVE-2026-59324 via org.springframework.integration:spring-integration-core (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-core MAVEN version =7.0.0-m1, =8.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 -...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3) +730 more potentially affected by CVE-2026-59322 via org.springframework.integration:spring-integration-core (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-core MAVEN version =7.0.0-m1, =8.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 -...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3) +730 more potentially affected by CVE-2026-59292 via org.springframework.integration:spring-integration-core (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-core MAVEN version =7.0.0-m1, =8.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 -...

org.springframework.integration:spring-integration-groovy (>=7.0.0-m1, <=7.0.5) potentially affected by CVE-2026-59321 via org.springframework.integration:spring-integration-scripting (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-scripting MAVEN version =7.0.0-m1, =7.0.0-m1, =7.0.5 Source cves: CVE-2026-59321 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKINTEGRATION-19265077...

ch.sbb:spring-cloud-stream-binder-solace (>=9.1.0, <=9.3.0), cn.herodotus.dante:dante-authentication-autoconfigure (4.1.0.1) +522 more potentially affected by CVE-2026-59324 via org.springframework.integration:spring-integration-core (7.1.0)

org.springframework.integration:spring-integration-core MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-core and may be impacted: - ch.sbb:spring-cloud-stream-binder-solace =9.1.0,...

ch.sbb:spring-cloud-stream-binder-solace (>=9.1.0, <=9.3.0), cn.herodotus.dante:dante-authentication-autoconfigure (4.1.0.1) +522 more potentially affected by CVE-2026-59322 via org.springframework.integration:spring-integration-core (7.1.0)

org.springframework.integration:spring-integration-core MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-core and may be impacted: - ch.sbb:spring-cloud-stream-binder-solace =9.1.0,...

org.springframework.cloud.fn:spring-syslog-supplier (6.0.0) potentially affected by CVE-2026-47859 via org.springframework.integration:spring-integration-syslog (7.0.4)

org.springframework.integration:spring-integration-syslog MAVEN version 7.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-syslog and may be impacted: -...

org.springframework.integration:spring-integration-syslog (7.1.0) potentially affected by CVE-2026-47861 via org.springframework.integration:spring-integration-ip (7.1.0)

org.springframework.integration:spring-integration-ip MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ip and may be impacted: -...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions via the PropertiesPersistingMetadataStore. An attacker can access sensitive metadata, such as processed message keys, offsets, or idempotency markers, by reading the world-readable metadata file created in ...

Exposure of Data Element to Wrong Session

Overview Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the fluxTransform when used with an asynchronous or reordering fluxFunction that emits raw payloads. An attacker can access another user's reply headers and cause reply mis-routing by sendin...

ch.sbb:spring-cloud-stream-binder-solace (>=9.1.0, <=9.3.0), cn.herodotus.dante:dante-authentication-autoconfigure (4.1.0.1) +522 more potentially affected by CVE-2026-59292 via org.springframework.integration:spring-integration-core (7.1.0)

org.springframework.integration:spring-integration-core MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-core and may be impacted: - ch.sbb:spring-cloud-stream-binder-solace =9.1.0,...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition via the ScriptEngine process. An attacker can access sensitive data from other requests or cause unexpected exceptions by triggering concurrent script evaluations. Remediation Upgrade...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the decodeNativeFormat. An attacker can inject arbitrary entries into MessageHeaders, including sensitive control headers, by sending...