ai.astraform:remote-domain-conformance-java (0.2.0), ai.astraform:remote-domain-template-java-spring (0.2.0) +4021 more potentially affected by CVE-2026-47887 via org.springframework:spring-webmvc (>=7.0.0, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =7.0.0, =0.1.0, =0.0.1, =0.0.1, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-47887 Source advisory: MEND:CVE-2026-47887...

ai.astraform:remote-domain-conformance-java (0.2.0), ai.astraform:remote-domain-template-java-spring (0.2.0) +4021 more potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (>=7.0.0, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =7.0.0, =0.1.0, =0.0.1, =0.0.1, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-47884 Source advisory: MEND:CVE-2026-47884...

br.com.archbase:archbase-starter (>=3.0.0, <=3.1.8), br.com.archbase:archbase-starter-core (>=3.0.0, <=3.1.8) +29 more potentially affected by CVE-2026-47850 via org.springframework.data:spring-data-rest-webmvc (5.1.0)

org.springframework.data:spring-data-rest-webmvc MAVEN version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-webmvc and may be impacted: - br.com.archbase:archbase-starter =3.0.0, =3.0.0, =3.0.2, =3.0.2...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.3) +32 more potentially affected by CVE-2026-47850 via org.springframework.data:spring-data-rest-webmvc (>=5.0.0, <=5.0.6)

org.springframework.data:spring-data-rest-webmvc MAVEN version =5.0.0, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =7.0.3, =7.0.3, =7.0.3, =2026.05, =2026.06 - io.github.vsvyatski:content-fs-spring-boot-starter 4.0.0 and more Source cves: CVE-2026-47850 Source advisory: MEND...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +78 more potentially affected by CVE-2026-47850 via org.springframework.data:spring-data-rest-webmvc (>=4.5.0, <=4.5.12)

org.springframework.data:spring-data-rest-webmvc MAVEN version =4.5.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-47850 Source advisory: MEND:CVE-2026-47850...

ai.authplane.sdk:authplane-spring (>=0.1.0, <=0.3.0), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +29 more potentially affected by CVE-2026-59279 via org.springframework.ai:mcp-spring-webmvc (2.0.0)

org.springframework.ai:mcp-spring-webmvc MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.ai:mcp-spring-webmvc and may be impacted: - ai.authplane.sdk:authplane-spring =0.1.0, =0.0.1, =0.0.1, =0.0.5, =1.5.0, =1.5....

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through unbounded session retention in the handleInitRequest path of WebFluxStreamableServerTransportProvider and WebMvcStreamableServerTransportProvider. An unauthenticated remote...

ai.authplane.sdk:authplane-spring (>=0.1.0, <=0.3.0), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +29 more potentially affected by CVE-2026-59279 via org.springframework.ai:mcp-spring-webmvc (2.0.0)

org.springframework.ai:mcp-spring-webmvc MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.ai:mcp-spring-webmvc and may be impacted: - ai.authplane.sdk:authplane-spring =0.1.0, =0.0.1, =0.0.1, =0.0.5, =1.5.0, =1.5....

CVE-2026-59279: Allocation of Resources Without Limits or Throttling

The MCP Streamable HTTP server transport WebFlux and WebMvc variants does not place any limit on the number of sessions it retains, and by default does not require clients to be authenticated. As a result, a remote attacker can cause the server to accumulate an unbounded number of sessions over...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.ancf.lmos:lmos-operator (>=0.5.0, <=0.6.0) +9639 more potentially affected by CVE-2026-47890 via org.springframework:spring-webmvc (>=6.2.0, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =6.2.0, =0.5.0, =0.1.2, =0.1.3, =0.1.0, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.29 and more Source cves: CVE-2026-47890 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267094...

Improper Neutralization

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Improper Neutralization in the...

Open Redirect

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Open Redirect in the UrlHandlerFilter...

ai.astraform:remote-domain-conformance-java (0.2.0), ai.astraform:remote-domain-template-java-spring (0.2.0) +4030 more potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-47884 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267098...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.ancf.lmos:lmos-operator (>=0.5.0, <=0.6.0) +9639 more potentially affected by CVE-2026-47883 via org.springframework:spring-webmvc (>=6.2.0, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =6.2.0, =0.5.0, =0.1.2, =0.1.3, =0.1.0, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.29 and more Source cves: CVE-2026-47883 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267433...

Cross-site Scripting (XSS)

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS when sending vi...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +22272 more potentially affected by CVE-2026-59313 via org.springframework:spring-webmvc (>=5.3.0, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =0.2.0, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo 0.1.0 - ai.apiprism:apiprism-spring-boot-starter 0.1.0 and more Source cves:...

ai.astraform:remote-domain-conformance-java (0.2.0), ai.astraform:remote-domain-template-java-spring (0.2.0) +4030 more potentially affected by CVE-2026-47887 via org.springframework:spring-webmvc (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-47887 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267099...

Arbitrary Code Injection

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Arbitrary Code Injection via the XsltVie...

eu.solven.adhoc:pivotable-js (0.1.0), eu.solven.adhoc:pivotable-server (0.1.0) +2 more potentially affected by CVE-2026-71439 via org.webjars.npm:mermaid (11.15.0)

org.webjars.npm:mermaid MAVEN version 11.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:mermaid and may be impacted: - eu.solven.adhoc:pivotable-js 0.1.0 - eu.solven.adhoc:pivotable-server 0.1.0 -...

eu.solven.adhoc:pivotable-js (0.1.0), eu.solven.adhoc:pivotable-server (0.1.0) +2 more potentially affected by CVE-2026-71438 via org.webjars.npm:mermaid (11.15.0)

org.webjars.npm:mermaid MAVEN version 11.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:mermaid and may be impacted: - eu.solven.adhoc:pivotable-js 0.1.0 - eu.solven.adhoc:pivotable-server 0.1.0 -...