CLSA-2026-1789455724 TuxCare security update for org.springframework.hateoas:spring-hateoas (2 CVEs)

TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 2.2.5-tuxcare.1...

ROOT-APP-MAVEN-CVE-2026-41700 CVE-2026-41700 in org.springframework.graphql:spring-graphql - Patched by Root

Root has patched CVE-2026-41700 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41856 CVE-2026-41856 in org.springframework.graphql:spring-graphql - Patched by Root

Root has patched CVE-2026-41856 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41699 CVE-2026-41699 in org.springframework.graphql:spring-graphql - Patched by Root

Root has patched CVE-2026-41699 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available...

CLSA-2026-1789453747 TuxCare security update for org.springframework.amqp (1 CVE)

TuxCare rebuilt 4 org.springframework.amqp packages to address 1 CVE. Fixed in 2.3.7-tuxcare.1...

EUVD-2026-78168

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CLSA-2026-1789427454 TuxCare security update for org.springframework (18 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 18 CVEs. Fixed in 5.3.6-tuxcare.1...

CVE-2026-91145

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145

Activiti through 7.1.0.M6 contains an expression injection vulnerability in its mail task handling. The root cause is a failure to validate hash-brace (#{}) deferred expressions in process variables, allowing an attacker to bypass expression filtering. Injected expressions are stored and later ev...

CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CLSA-2026-1789416166 TuxCare security update for org.springframework (12 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 12 CVEs. Fixed in 4.3.4.RELEASE-tuxcare.5...

CLSA-2026-1789410116 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.8.16-tuxcare.15...

CLSA-2026-1789407633 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.7.12-tuxcare.9...

CLSA-2026-1789400252 TuxCare security update for org.springframework.ldap:spring-ldap-core (1 CVE)

TuxCare rebuilt org.springframework.ldap:spring-ldap-core to address 1 CVE. Fixed in 2.3.3.RELEASE-tuxcare.1...

Incorrect Privilege Assignment

Overview Affected versions of this package are vulnerable to Incorrect Privilege Assignment in the JWT authentication process when the JWKS settings, including protocol and key, are disclosed. An attacker can gain administrative privileges by authenticating with a valid low-privilege JWT and...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection in the CommandArgs static implementation. An attacker can execute arbitrary code by crafting a malicious Groovy Command class that bypasses the Groovy security sandbox. Remediation Upgrade...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the process of configuring an AES key of non-standard length, where the provided value is padded with random characters and the resulting key is output to log files. An attacker can...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation in the JWT authentication process when the JWKS settings, including at least the protocol and key, are disclosed. An attacker can gain unauthorized access to another user's privileges by spoofing the JWT subject after...