CVE-2026-41001

CVE-2026-41001 affects Spring Boot’s ArtemisEmbeddedConfigurationFactory, which uses a fixed, static path for the embedded Artemis broker data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before appli...

CVE-2026-40992

CVE-2026-40992 concerns Spring Boot's Mail auto-configuration not enabling hostname verification by default. Affected: Spring Boot 4.0.0–4.0.6; 3.5.0–3.5.14; 3.4.0–3.4.16. The issue: hostname verification is not enabled; applications that explicitly set spring.mail.properties.mail.smtp.ssl.checks...

CVE-2018-1196

The CVE-2018-1196 issue affects Spring Boot when using the embedded launch script to run as a systemd/init.d service. The root cause is a symlink attack on the run_user, enabling overwriting/taking ownership of files on the same system if the app is installed as a service and the run_user has she...