Trivy Delta Report
Report Information
| Generated At | 2026-05-27T03:37:54.418178-07:00 |
|---|---|
| --input-from | input/trivy-report-cadenzaflow-v1.1.0.json |
| --input-to | input/trivy-report-cadenzaflow-v1.2.0.json |
| --output | output/delta-cadenzaflow-v1.1.0-cadenzaflow-v1.2.0.html |
Vulnerability Summary
| Severity | Status | Count |
|---|---|---|
| CRITICAL | FIXED | 17 |
| CRITICAL | CONTINUED | 2 |
| CRITICAL | NEW | 4 |
| HIGH | FIXED | 55 |
| HIGH | CONTINUED | 10 |
| HIGH | NEW | 6 |
| MEDIUM | FIXED | 67 |
| MEDIUM | CONTINUED | 18 |
| MEDIUM | NEW | 3 |
| LOW | FIXED | 35 |
| LOW | CONTINUED | 6 |
| LOW | NEW | 1 |
Vulnerabilities
| Status | Severity | CVE | Package | Installed | Fixed | Target | Title |
|---|---|---|---|---|---|---|---|
| FIXED | CRITICAL | CVE-2019-10202 | org.codehaus.jackson:jackson-mapper-asl | 1.9.11 | qa/performance-tests-engine/pom.xml | codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities | |
| FIXED | CRITICAL | CVE-2025-7783 | form-data | 4.0.0 | 2.5.4, 3.0.4, 4.0.4 | webapps/frontend/package-lock.json | Use of Insufficiently Random Values vulnerability in form-data allows ... |
| FIXED | CRITICAL | CVE-2026-22732 | org.springframework.security:spring-security-web | 6.5.3 | 6.5.9, 7.0.4 | spring-boot-starter/starter-security/pom.xml | Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers |
| FIXED | CRITICAL | CVE-2026-25896 | fast-xml-parser | 4.3.4 | 5.3.5, 4.5.4 | webapps/frontend/package-lock.json | fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling |
| FIXED | CRITICAL | CVE-2026-29145 | org.apache.tomcat:tomcat | 10.1.43 | 9.0.116, 10.1.53, 11.0.20 | distro/tomcat/assembly/pom.xml | Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration |
| FIXED | CRITICAL | CVE-2026-41293 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | distro/run/core/pom.xml | Improper Input Validation vulnerability in Apache Tomcat. This issue ... |
| FIXED | CRITICAL | CVE-2026-41293 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | Improper Input Validation vulnerability in Apache Tomcat. This issue ... |
| FIXED | CRITICAL | CVE-2026-41293 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | spring-boot-starter/starter-webapp-core/pom.xml | Improper Input Validation vulnerability in Apache Tomcat. This issue ... |
| FIXED | CRITICAL | CVE-2026-41293 | org.apache.tomcat:tomcat | 10.1.43 | 9.0.118, 10.1.55, 11.0.22 | distro/tomcat/assembly/pom.xml | Improper Input Validation vulnerability in Apache Tomcat. This issue ... |
| FIXED | CRITICAL | CVE-2026-43512 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | distro/run/core/pom.xml | DEPRECATED: Authentication Bypass Issues vulnerability in digest authe ... |
| FIXED | CRITICAL | CVE-2026-43512 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | DEPRECATED: Authentication Bypass Issues vulnerability in digest authe ... |
| FIXED | CRITICAL | CVE-2026-43512 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | spring-boot-starter/starter-webapp-core/pom.xml | DEPRECATED: Authentication Bypass Issues vulnerability in digest authe ... |
| FIXED | CRITICAL | CVE-2026-43512 | org.apache.tomcat:tomcat | 10.1.43 | 9.0.118, 10.1.55, 11.0.22 | distro/tomcat/assembly/pom.xml | DEPRECATED: Authentication Bypass Issues vulnerability in digest authe ... |
| FIXED | CRITICAL | CVE-2026-43515 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | distro/run/core/pom.xml | Improper Authorization vulnerability when multiple method constraints ... |
| FIXED | CRITICAL | CVE-2026-43515 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | Improper Authorization vulnerability when multiple method constraints ... |
| FIXED | CRITICAL | CVE-2026-43515 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | spring-boot-starter/starter-webapp-core/pom.xml | Improper Authorization vulnerability when multiple method constraints ... |
| FIXED | CRITICAL | CVE-2026-43515 | org.apache.tomcat:tomcat | 10.1.43 | 9.0.118, 10.1.55, 11.0.22 | distro/tomcat/assembly/pom.xml | Improper Authorization vulnerability when multiple method constraints ... |
| FIXED | HIGH | CVE-2019-10172 | org.codehaus.jackson:jackson-mapper-asl | 1.9.11 | qa/performance-tests-engine/pom.xml | jackson-mapper-asl: XML external entity similar to CVE-2016-3720 | |
| FIXED | HIGH | CVE-2023-6378 | ch.qos.logback:logback-classic | 1.2.11 | 1.3.12, 1.4.12, 1.2.13 | commons/pom.xml | logback: serialization vulnerability in logback receiver |
| FIXED | HIGH | CVE-2023-6378 | ch.qos.logback:logback-classic | 1.2.11 | 1.3.12, 1.4.12, 1.2.13 | commons/testing/pom.xml | logback: serialization vulnerability in logback receiver |
| FIXED | HIGH | CVE-2023-6378 | ch.qos.logback:logback-core | 1.2.11 | 1.3.12, 1.4.12, 1.2.13 | commons/pom.xml | logback: serialization vulnerability in logback receiver |
| FIXED | HIGH | CVE-2023-6378 | ch.qos.logback:logback-core | 1.2.11 | 1.3.12, 1.4.12, 1.2.13 | commons/testing/pom.xml | logback: serialization vulnerability in logback receiver |
| FIXED | HIGH | CVE-2025-41248 | org.springframework.security:spring-security-core | 6.5.3 | 6.4.10, 6.5.4 | spring-boot-starter/starter-security/pom.xml | Spring Security annotation detection mechanism has authorization bypass |
| FIXED | HIGH | CVE-2025-41249 | org.springframework:spring-core | 6.2.10 | 6.2.11 | distro/run/core/pom.xml | The Spring Framework annotation detection mechanism may not correctly ... |
| FIXED | HIGH | CVE-2025-41249 | org.springframework:spring-core | 6.2.10 | 6.2.11 | engine/pom.xml | The Spring Framework annotation detection mechanism may not correctly ... |
| FIXED | HIGH | CVE-2025-41249 | org.springframework:spring-core | 6.2.10 | 6.2.11 | qa/integration-tests-engine-jakarta/pom.xml | The Spring Framework annotation detection mechanism may not correctly ... |
| FIXED | HIGH | CVE-2025-41249 | org.springframework:spring-core | 6.2.10 | 6.2.11 | spring-boot-starter/starter-client/spring-boot/pom.xml | The Spring Framework annotation detection mechanism may not correctly ... |
| FIXED | HIGH | CVE-2025-41249 | org.springframework:spring-core | 6.2.10 | 6.2.11 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | The Spring Framework annotation detection mechanism may not correctly ... |
| FIXED | HIGH | CVE-2025-41249 | org.springframework:spring-core | 6.2.10 | 6.2.11 | spring-boot-starter/starter-security/pom.xml | The Spring Framework annotation detection mechanism may not correctly ... |
| FIXED | HIGH | CVE-2025-41249 | org.springframework:spring-core | 6.2.10 | 6.2.11 | spring-boot-starter/starter-test/pom.xml | The Spring Framework annotation detection mechanism may not correctly ... |
| FIXED | HIGH | CVE-2025-41249 | org.springframework:spring-core | 6.2.10 | 6.2.11 | spring-boot-starter/starter-webapp-core/pom.xml | The Spring Framework annotation detection mechanism may not correctly ... |
| FIXED | HIGH | CVE-2025-41249 | org.springframework:spring-core | 6.2.10 | 6.2.11 | spring-boot-starter/starter/pom.xml | The Spring Framework annotation detection mechanism may not correctly ... |
| FIXED | HIGH | CVE-2025-55752 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.11, 10.1.45, 9.0.109 | distro/run/core/pom.xml | Relative Path Traversal vulnerability in Apache Tomcat. The fix for b ... |
| FIXED | HIGH | CVE-2025-55752 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.11, 10.1.45, 9.0.109 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | Relative Path Traversal vulnerability in Apache Tomcat. The fix for b ... |
| FIXED | HIGH | CVE-2025-55752 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.11, 10.1.45, 9.0.109 | spring-boot-starter/starter-webapp-core/pom.xml | Relative Path Traversal vulnerability in Apache Tomcat. The fix for b ... |
| FIXED | HIGH | CVE-2025-55752 | org.apache.tomcat:tomcat | 10.1.43 | 11.0.11, 10.1.45, 9.0.109 | distro/tomcat/assembly/pom.xml | Relative Path Traversal vulnerability in Apache Tomcat. The fix for b ... |
| FIXED | HIGH | CVE-2026-24400 | org.assertj:assertj-core | 3.27.4 | 3.27.7 | spring-boot-starter/starter-test/pom.xml | assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE) |
| FIXED | HIGH | CVE-2026-24734 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.18, 10.1.52, 9.0.115 | distro/run/core/pom.xml | tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation |
| FIXED | HIGH | CVE-2026-24734 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.18, 10.1.52, 9.0.115 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation |
| FIXED | HIGH | CVE-2026-24734 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.18, 10.1.52, 9.0.115 | spring-boot-starter/starter-webapp-core/pom.xml | tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation |
| FIXED | HIGH | CVE-2026-24880 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.116, 10.1.52, 11.0.20 | distro/run/core/pom.xml | Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension |
| FIXED | HIGH | CVE-2026-24880 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.116, 10.1.52, 11.0.20 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension |
| FIXED | HIGH | CVE-2026-24880 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.116, 10.1.52, 11.0.20 | spring-boot-starter/starter-webapp-core/pom.xml | Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension |
| FIXED | HIGH | CVE-2026-26278 | fast-xml-parser | 4.3.4 | 4.5.4, 5.3.6 | webapps/frontend/package-lock.json | fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion |
| FIXED | HIGH | CVE-2026-33036 | fast-xml-parser | 4.3.4 | 5.5.6, 4.5.5 | webapps/frontend/package-lock.json | fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass |
| FIXED | HIGH | CVE-2026-34483 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.116, 10.1.54, 11.0.21 | distro/run/core/pom.xml | Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve |
| FIXED | HIGH | CVE-2026-34483 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.116, 10.1.54, 11.0.21 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve |
| FIXED | HIGH | CVE-2026-34483 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.116, 10.1.54, 11.0.21 | spring-boot-starter/starter-webapp-core/pom.xml | Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve |
| FIXED | HIGH | CVE-2026-34483 | org.apache.tomcat:tomcat | 10.1.43 | 9.0.116, 10.1.54, 11.0.21 | distro/tomcat/assembly/pom.xml | Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve |
| FIXED | HIGH | CVE-2026-34487 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.117, 10.1.54, 11.0.21 | distro/run/core/pom.xml | Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files |
| FIXED | HIGH | CVE-2026-34487 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.117, 10.1.54, 11.0.21 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files |
| FIXED | HIGH | CVE-2026-34487 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.117, 10.1.54, 11.0.21 | spring-boot-starter/starter-webapp-core/pom.xml | Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files |
| FIXED | HIGH | CVE-2026-34487 | org.apache.tomcat:tomcat | 10.1.43 | 9.0.117, 10.1.54, 11.0.21 | distro/tomcat/assembly/pom.xml | Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files |
| FIXED | HIGH | CVE-2026-40973 | org.springframework.boot:spring-boot | 3.5.5 | 4.0.6, 3.5.14 | spring-boot-starter/starter-client/spring-boot/pom.xml | Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory |
| FIXED | HIGH | CVE-2026-40973 | org.springframework.boot:spring-boot | 3.5.5 | 4.0.6, 3.5.14 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory |
| FIXED | HIGH | CVE-2026-40973 | org.springframework.boot:spring-boot | 3.5.5 | 4.0.6, 3.5.14 | spring-boot-starter/starter-security/pom.xml | Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory |
| FIXED | HIGH | CVE-2026-40973 | org.springframework.boot:spring-boot | 3.5.5 | 4.0.6, 3.5.14 | spring-boot-starter/starter-test/pom.xml | Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory |
| FIXED | HIGH | CVE-2026-40973 | org.springframework.boot:spring-boot | 3.5.5 | 4.0.6, 3.5.14 | spring-boot-starter/starter-webapp-core/pom.xml | Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory |
| FIXED | HIGH | CVE-2026-40973 | org.springframework.boot:spring-boot | 3.5.5 | 4.0.6, 3.5.14 | spring-boot-starter/starter/pom.xml | Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory |
| FIXED | HIGH | CVE-2026-41284 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | distro/run/core/pom.xml | Allocation of Resources Without Limits or Throttling vulnerability in ... |
| FIXED | HIGH | CVE-2026-41284 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | Allocation of Resources Without Limits or Throttling vulnerability in ... |
| FIXED | HIGH | CVE-2026-41284 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | spring-boot-starter/starter-webapp-core/pom.xml | Allocation of Resources Without Limits or Throttling vulnerability in ... |
| FIXED | HIGH | CVE-2026-41284 | org.apache.tomcat:tomcat | 10.1.43 | 9.0.118, 10.1.55, 11.0.22 | distro/tomcat/assembly/pom.xml | Allocation of Resources Without Limits or Throttling vulnerability in ... |
| FIXED | HIGH | CVE-2026-42498 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | distro/run/core/pom.xml | Exposure of HTTP Authentication Header to unexpected hosts during WebS ... |
| FIXED | HIGH | CVE-2026-42498 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | Exposure of HTTP Authentication Header to unexpected hosts during WebS ... |
| FIXED | HIGH | CVE-2026-42498 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | spring-boot-starter/starter-webapp-core/pom.xml | Exposure of HTTP Authentication Header to unexpected hosts during WebS ... |
| FIXED | HIGH | CVE-2026-42498 | org.apache.tomcat:tomcat | 10.1.43 | 9.0.118, 10.1.55, 11.0.22 | distro/tomcat/assembly/pom.xml | Exposure of HTTP Authentication Header to unexpected hosts during WebS ... |
| FIXED | HIGH | CVE-2026-43513 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | distro/run/core/pom.xml | Improper Handling of Case Sensitivity vulnerability in LockOutRealm in ... |
| FIXED | HIGH | CVE-2026-43513 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | Improper Handling of Case Sensitivity vulnerability in LockOutRealm in ... |
| FIXED | HIGH | CVE-2026-43513 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | spring-boot-starter/starter-webapp-core/pom.xml | Improper Handling of Case Sensitivity vulnerability in LockOutRealm in ... |
| FIXED | HIGH | CVE-2026-43513 | org.apache.tomcat:tomcat | 10.1.43 | 9.0.118, 10.1.55, 11.0.22 | distro/tomcat/assembly/pom.xml | Improper Handling of Case Sensitivity vulnerability in LockOutRealm in ... |
| FIXED | HIGH | CVE-2026-4800 | lodash | 4.17.21 | 4.18.0 | webapps/frontend/package-lock.json | lodash: lodash: Arbitrary code execution via untrusted input in template imports |
| FIXED | MEDIUM | CVE-2024-12798 | ch.qos.logback:logback-core | 1.2.11 | 1.5.13, 1.3.15 | commons/pom.xml | ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core ... |
| FIXED | MEDIUM | CVE-2024-12798 | ch.qos.logback:logback-core | 1.2.11 | 1.5.13, 1.3.15 | commons/testing/pom.xml | ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core ... |
| FIXED | MEDIUM | CVE-2025-11226 | ch.qos.logback:logback-core | 1.2.11 | 1.5.19, 1.3.16 | commons/pom.xml | QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing |
| FIXED | MEDIUM | CVE-2025-11226 | ch.qos.logback:logback-core | 1.2.11 | 1.5.19, 1.3.16 | commons/testing/pom.xml | QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing |
| FIXED | MEDIUM | CVE-2025-11226 | ch.qos.logback:logback-core | 1.5.18 | 1.5.19, 1.3.16 | spring-boot-starter/starter-client/spring-boot/pom.xml | QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing |
| FIXED | MEDIUM | CVE-2025-11226 | ch.qos.logback:logback-core | 1.5.18 | 1.5.19, 1.3.16 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing |
| FIXED | MEDIUM | CVE-2025-11226 | ch.qos.logback:logback-core | 1.5.18 | 1.5.19, 1.3.16 | spring-boot-starter/starter-security/pom.xml | QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing |
| FIXED | MEDIUM | CVE-2025-11226 | ch.qos.logback:logback-core | 1.5.18 | 1.5.19, 1.3.16 | spring-boot-starter/starter-test/pom.xml | QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing |
| FIXED | MEDIUM | CVE-2025-11226 | ch.qos.logback:logback-core | 1.5.18 | 1.5.19, 1.3.16 | spring-boot-starter/starter-webapp-core/pom.xml | QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing |
| FIXED | MEDIUM | CVE-2025-11226 | ch.qos.logback:logback-core | 1.5.18 | 1.5.19, 1.3.16 | spring-boot-starter/starter/pom.xml | QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing |
| FIXED | MEDIUM | CVE-2025-13465 | lodash | 4.17.21 | 4.17.23 | webapps/frontend/package-lock.json | lodash: prototype pollution in _.unset and _.omit functions |
| FIXED | MEDIUM | CVE-2025-15284 | qs | 6.13.0 | 6.14.1 | webapps/frontend/package-lock.json | Improper Input Validation vulnerability in qs (parse modules) allows H ... |
| FIXED | MEDIUM | CVE-2025-15599 | dompurify | 3.2.4 | 3.2.7 | webapps/frontend/package-lock.json | DOMPurify: DOMPurify: Cross-site scripting |
| FIXED | MEDIUM | CVE-2025-15599 | dompurify | 3.2.5 | 3.2.7 | engine-rest/docs/package-lock.json | DOMPurify: DOMPurify: Cross-site scripting |
| FIXED | MEDIUM | CVE-2025-48924 | org.apache.commons:commons-lang3 | 3.17.0 | 3.18.0 | spring-boot-starter/starter/pom.xml | Uncontrolled Recursion vulnerability in Apache Commons Lang. This iss ... |
| FIXED | MEDIUM | CVE-2025-53864 | com.nimbusds:nimbus-jose-jwt | 9.37.3 | 10.0.2, 9.37.4 | spring-boot-starter/starter-security/pom.xml | Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON |
| FIXED | MEDIUM | CVE-2025-66614 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.15, 10.1.50, 9.0.113 | distro/run/core/pom.xml | tomcat: Client certificate verification bypass due to virtual host mapping |
| FIXED | MEDIUM | CVE-2025-66614 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.15, 10.1.50, 9.0.113 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | tomcat: Client certificate verification bypass due to virtual host mapping |
| FIXED | MEDIUM | CVE-2025-66614 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.15, 10.1.50, 9.0.113 | spring-boot-starter/starter-webapp-core/pom.xml | tomcat: Client certificate verification bypass due to virtual host mapping |
| FIXED | MEDIUM | CVE-2025-66614 | org.apache.tomcat:tomcat | 10.1.43 | 11.0.15, 10.1.50, 9.0.113 | distro/tomcat/assembly/pom.xml | tomcat: Client certificate verification bypass due to virtual host mapping |
| FIXED | MEDIUM | CVE-2026-0540 | dompurify | 3.2.4 | 3.3.2, 2.5.9 | webapps/frontend/package-lock.json | DOMPurify: DOMPurify: Cross-site scripting vulnerability |
| FIXED | MEDIUM | CVE-2026-0540 | dompurify | 3.2.5 | 3.3.2, 2.5.9 | engine-rest/docs/package-lock.json | DOMPurify: DOMPurify: Cross-site scripting vulnerability |
| FIXED | MEDIUM | CVE-2026-22737 | org.springframework:spring-webmvc | 6.2.10 | 7.0.6, 6.2.17 | distro/run/core/pom.xml | Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views |
| FIXED | MEDIUM | CVE-2026-22737 | org.springframework:spring-webmvc | 6.2.10 | 7.0.6, 6.2.17 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views |
| FIXED | MEDIUM | CVE-2026-22737 | org.springframework:spring-webmvc | 6.2.10 | 7.0.6, 6.2.17 | spring-boot-starter/starter-webapp-core/pom.xml | Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views |
| FIXED | MEDIUM | CVE-2026-22745 | org.springframework:spring-webmvc | 6.2.10 | 7.0.7, 6.2.18 | distro/run/core/pom.xml | spring-webflux: Spring MVC and Spring WebFlux: Denial of Service via slow static resource resolution on Windows |
| FIXED | MEDIUM | CVE-2026-22745 | org.springframework:spring-webmvc | 6.2.10 | 7.0.7, 6.2.18 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | spring-webflux: Spring MVC and Spring WebFlux: Denial of Service via slow static resource resolution on Windows |
| FIXED | MEDIUM | CVE-2026-22745 | org.springframework:spring-webmvc | 6.2.10 | 7.0.7, 6.2.18 | spring-boot-starter/starter-webapp-core/pom.xml | spring-webflux: Spring MVC and Spring WebFlux: Denial of Service via slow static resource resolution on Windows |
| FIXED | MEDIUM | CVE-2026-22748 | org.springframework.security:spring-security-oauth2-jose | 6.5.3 | 6.5.10, 7.0.5 | spring-boot-starter/starter-security/pom.xml | Spring Security: Spring Security: Integrity impact due to improper JSON Web Token (JWT) validation |
| FIXED | MEDIUM | CVE-2026-22751 | org.springframework.security:spring-security-core | 6.5.3 | 6.5.10, 7.0.5 | spring-boot-starter/starter-security/pom.xml | Spring Security: JdbcOneTimeTokenService: Spring Security: Authentication bypass due to race condition in One-Time Token login |
| FIXED | MEDIUM | CVE-2026-25854 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.116, 10.1.53, 11.0.20 | distro/run/core/pom.xml | Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve |
| FIXED | MEDIUM | CVE-2026-25854 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.116, 10.1.53, 11.0.20 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve |
| FIXED | MEDIUM | CVE-2026-25854 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.116, 10.1.53, 11.0.20 | spring-boot-starter/starter-webapp-core/pom.xml | Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve |
| FIXED | MEDIUM | CVE-2026-25854 | org.apache.tomcat:tomcat | 10.1.43 | 9.0.116, 10.1.53, 11.0.20 | distro/tomcat/assembly/pom.xml | Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve |
| FIXED | MEDIUM | CVE-2026-2950 | lodash | 4.17.21 | 4.18.0 | webapps/frontend/package-lock.json | lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass |
| FIXED | MEDIUM | CVE-2026-33349 | fast-xml-parser | 4.3.4 | 4.5.5, 5.5.7 | webapps/frontend/package-lock.json | fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling |
| FIXED | MEDIUM | CVE-2026-41238 | dompurify | 3.2.4 | 3.4.0 | webapps/frontend/package-lock.json | DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution |
| FIXED | MEDIUM | CVE-2026-41238 | dompurify | 3.2.5 | 3.4.0 | engine-rest/docs/package-lock.json | DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution |
| FIXED | MEDIUM | CVE-2026-41239 | dompurify | 3.2.4 | 3.4.0 | webapps/frontend/package-lock.json | DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions |
| FIXED | MEDIUM | CVE-2026-41239 | dompurify | 3.2.5 | 3.4.0 | engine-rest/docs/package-lock.json | DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions |
| FIXED | MEDIUM | CVE-2026-41240 | dompurify | 3.2.4 | 3.4.0 | webapps/frontend/package-lock.json | DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization |
| FIXED | MEDIUM | CVE-2026-41240 | dompurify | 3.2.5 | 3.4.0 | engine-rest/docs/package-lock.json | DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization |
| FIXED | MEDIUM | CVE-2026-41650 | fast-xml-parser | 4.3.4 | 5.7.0 | webapps/frontend/package-lock.json | fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences |
| FIXED | MEDIUM | CVE-2026-8723 | qs | 6.13.0 | 6.15.2 | webapps/frontend/package-lock.json | ### Summary `qs.stringify` throws `TypeError` when called with `arr ... |
| FIXED | MEDIUM | GHSA-39q2-94rc-95cp | dompurify | 3.2.4 | 3.4.0 | webapps/frontend/package-lock.json | DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation |
| FIXED | MEDIUM | GHSA-39q2-94rc-95cp | dompurify | 3.2.5 | 3.4.0 | engine-rest/docs/package-lock.json | DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation |
| FIXED | MEDIUM | GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.15.2 | 2.21.1, 2.18.6 | clients/java/client/pom.xml | jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition |
| FIXED | MEDIUM | GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.15.2 | 2.21.1, 2.18.6 | clients/java/pom.xml | jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition |
| FIXED | MEDIUM | GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.15.2 | 2.21.1, 2.18.6 | engine-rest/engine-rest-jakarta/pom.xml | jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition |
| FIXED | MEDIUM | GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.15.2 | 2.21.1, 2.18.6 | engine-rest/engine-rest-openapi-generator/pom.xml | jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition |
| FIXED | MEDIUM | GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.15.2 | 2.21.1, 2.18.6 | engine-rest/engine-rest/pom.xml | jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition |
| FIXED | MEDIUM | GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.15.2 | 2.21.1, 2.18.6 | engine-rest/pom.xml | jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition |
| FIXED | MEDIUM | GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.15.2 | 2.21.1, 2.18.6 | spin/dataformat-json-jackson/pom.xml | jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition |
| FIXED | MEDIUM | GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.15.2 | 2.21.1, 2.18.6 | spin/pom.xml | jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition |
| FIXED | MEDIUM | GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.15.2 | 2.21.1, 2.18.6 | webapps/assembly-jakarta/pom.xml | jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition |
| FIXED | MEDIUM | GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.15.2 | 2.21.1, 2.18.6 | webapps/pom.xml | jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition |
| FIXED | MEDIUM | GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.19.2 | 2.21.1, 2.18.6 | spring-boot-starter/starter-qa/integration-test-plugins/pom.xml | jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition |
| FIXED | MEDIUM | GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.19.2 | 2.21.1, 2.18.6 | spring-boot-starter/starter-qa/integration-test-plugins/spin/pom.xml | jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition |
| FIXED | MEDIUM | GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.19.2 | 2.21.1, 2.18.6 | spring-boot-starter/starter-qa/integration-test-plugins/spin/spin-dataformat-all/pom.xml | jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition |
| FIXED | MEDIUM | GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.19.2 | 2.21.1, 2.18.6 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition |
| FIXED | MEDIUM | GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.19.2 | 2.21.1, 2.18.6 | spring-boot-starter/starter-webapp-core/pom.xml | jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition |
| FIXED | MEDIUM | GHSA-cj63-jhhr-wcxv | dompurify | 3.2.4 | 3.3.2 | webapps/frontend/package-lock.json | DOMPurify USE_PROFILES prototype pollution allows event handlers |
| FIXED | MEDIUM | GHSA-cj63-jhhr-wcxv | dompurify | 3.2.5 | 3.3.2 | engine-rest/docs/package-lock.json | DOMPurify USE_PROFILES prototype pollution allows event handlers |
| FIXED | MEDIUM | GHSA-cjmm-f4jc-qw8r | dompurify | 3.2.4 | 3.3.2 | webapps/frontend/package-lock.json | DOMPurify ADD_ATTR predicate skips URI validation |
| FIXED | MEDIUM | GHSA-cjmm-f4jc-qw8r | dompurify | 3.2.5 | 3.3.2 | engine-rest/docs/package-lock.json | DOMPurify ADD_ATTR predicate skips URI validation |
| FIXED | MEDIUM | GHSA-h8r8-wccr-v5f2 | dompurify | 3.2.4 | 3.3.2 | webapps/frontend/package-lock.json | DOMPurify is vulnerable to mutation-XSS via Re-Contextualization |
| FIXED | MEDIUM | GHSA-h8r8-wccr-v5f2 | dompurify | 3.2.5 | 3.3.2 | engine-rest/docs/package-lock.json | DOMPurify is vulnerable to mutation-XSS via Re-Contextualization |
| FIXED | LOW | CVE-2024-12801 | ch.qos.logback:logback-core | 1.2.11 | 1.5.13, 1.3.15 | commons/pom.xml | Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logba ... |
| FIXED | LOW | CVE-2024-12801 | ch.qos.logback:logback-core | 1.2.11 | 1.5.13, 1.3.15 | commons/testing/pom.xml | Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logba ... |
| FIXED | LOW | CVE-2025-55754 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.11, 10.1.45, 9.0.109 | distro/run/core/pom.xml | Improper Neutralization of Escape, Meta, or Control Sequences vulnerab ... |
| FIXED | LOW | CVE-2025-55754 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.11, 10.1.45, 9.0.109 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | Improper Neutralization of Escape, Meta, or Control Sequences vulnerab ... |
| FIXED | LOW | CVE-2025-55754 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.11, 10.1.45, 9.0.109 | spring-boot-starter/starter-webapp-core/pom.xml | Improper Neutralization of Escape, Meta, or Control Sequences vulnerab ... |
| FIXED | LOW | CVE-2025-55754 | org.apache.tomcat:tomcat | 10.1.43 | 11.0.11, 10.1.45, 9.0.109 | distro/tomcat/assembly/pom.xml | Improper Neutralization of Escape, Meta, or Control Sequences vulnerab ... |
| FIXED | LOW | CVE-2025-61795 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.12, 10.1.47, 9.0.110 | distro/run/core/pom.xml | Improper Resource Shutdown or Release vulnerability in Apache Tomcat. ... |
| FIXED | LOW | CVE-2025-61795 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.12, 10.1.47, 9.0.110 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | Improper Resource Shutdown or Release vulnerability in Apache Tomcat. ... |
| FIXED | LOW | CVE-2025-61795 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.12, 10.1.47, 9.0.110 | spring-boot-starter/starter-webapp-core/pom.xml | Improper Resource Shutdown or Release vulnerability in Apache Tomcat. ... |
| FIXED | LOW | CVE-2025-61795 | org.apache.tomcat:tomcat | 10.1.43 | 11.0.12, 10.1.47, 9.0.110 | distro/tomcat/assembly/pom.xml | Improper Resource Shutdown or Release vulnerability in Apache Tomcat. ... |
| FIXED | LOW | CVE-2026-1225 | ch.qos.logback:logback-core | 1.2.11 | 1.5.25 | commons/pom.xml | ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes |
| FIXED | LOW | CVE-2026-1225 | ch.qos.logback:logback-core | 1.2.11 | 1.5.25 | commons/testing/pom.xml | ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes |
| FIXED | LOW | CVE-2026-1225 | ch.qos.logback:logback-core | 1.5.18 | 1.5.25 | spring-boot-starter/starter-client/spring-boot/pom.xml | ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes |
| FIXED | LOW | CVE-2026-1225 | ch.qos.logback:logback-core | 1.5.18 | 1.5.25 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes |
| FIXED | LOW | CVE-2026-1225 | ch.qos.logback:logback-core | 1.5.18 | 1.5.25 | spring-boot-starter/starter-security/pom.xml | ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes |
| FIXED | LOW | CVE-2026-1225 | ch.qos.logback:logback-core | 1.5.18 | 1.5.25 | spring-boot-starter/starter-test/pom.xml | ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes |
| FIXED | LOW | CVE-2026-1225 | ch.qos.logback:logback-core | 1.5.18 | 1.5.25 | spring-boot-starter/starter-webapp-core/pom.xml | ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes |
| FIXED | LOW | CVE-2026-1225 | ch.qos.logback:logback-core | 1.5.18 | 1.5.25 | spring-boot-starter/starter/pom.xml | ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes |
| FIXED | LOW | CVE-2026-22735 | org.springframework:spring-webmvc | 6.2.10 | 7.0.6, 6.2.17 | distro/run/core/pom.xml | org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events |
| FIXED | LOW | CVE-2026-22735 | org.springframework:spring-webmvc | 6.2.10 | 7.0.6, 6.2.17 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events |
| FIXED | LOW | CVE-2026-22735 | org.springframework:spring-webmvc | 6.2.10 | 7.0.6, 6.2.17 | spring-boot-starter/starter-webapp-core/pom.xml | org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events |
| FIXED | LOW | CVE-2026-22741 | org.springframework:spring-webmvc | 6.2.10 | 7.0.7, 6.2.18 | distro/run/core/pom.xml | Spring MVC: Spring WebFlux: Spring MVC and Spring WebFlux: Denial of Service via cache poisoning |
| FIXED | LOW | CVE-2026-22741 | org.springframework:spring-webmvc | 6.2.10 | 7.0.7, 6.2.18 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | Spring MVC: Spring WebFlux: Spring MVC and Spring WebFlux: Denial of Service via cache poisoning |
| FIXED | LOW | CVE-2026-22741 | org.springframework:spring-webmvc | 6.2.10 | 7.0.7, 6.2.18 | spring-boot-starter/starter-webapp-core/pom.xml | Spring MVC: Spring WebFlux: Spring MVC and Spring WebFlux: Denial of Service via cache poisoning |
| FIXED | LOW | CVE-2026-22746 | org.springframework.security:spring-security-core | 6.5.3 | 6.5.10, 7.0.5 | spring-boot-starter/starter-security/pom.xml | Spring Security: Spring Security: Timing attack defense bypass allows information disclosure |
| FIXED | LOW | CVE-2026-2391 | qs | 6.13.0 | 6.14.2 | webapps/frontend/package-lock.json | qs: qs's arrayLimit bypass in comma parsing allows denial of service |
| FIXED | LOW | CVE-2026-24733 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.15, 10.1.50, 9.0.113 | distro/run/core/pom.xml | tomcat: security constraint bypass with HTTP/0.9 |
| FIXED | LOW | CVE-2026-24733 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.15, 10.1.50, 9.0.113 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | tomcat: security constraint bypass with HTTP/0.9 |
| FIXED | LOW | CVE-2026-24733 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 11.0.15, 10.1.50, 9.0.113 | spring-boot-starter/starter-webapp-core/pom.xml | tomcat: security constraint bypass with HTTP/0.9 |
| FIXED | LOW | CVE-2026-24733 | org.apache.tomcat:tomcat | 10.1.43 | 11.0.15, 10.1.50, 9.0.113 | distro/tomcat/assembly/pom.xml | tomcat: security constraint bypass with HTTP/0.9 |
| FIXED | LOW | CVE-2026-27942 | fast-xml-parser | 4.3.4 | 5.3.8, 4.5.4 | webapps/frontend/package-lock.json | fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service |
| FIXED | LOW | CVE-2026-43514 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | distro/run/core/pom.xml | Observable Timing Discrepancy vulnerabilitywhen comparing AJP secret i ... |
| FIXED | LOW | CVE-2026-43514 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | spring-boot-starter/starter-qa/integration-test-request-scope/pom.xml | Observable Timing Discrepancy vulnerabilitywhen comparing AJP secret i ... |
| FIXED | LOW | CVE-2026-43514 | org.apache.tomcat.embed:tomcat-embed-core | 10.1.44 | 9.0.118, 10.1.55, 11.0.22 | spring-boot-starter/starter-webapp-core/pom.xml | Observable Timing Discrepancy vulnerabilitywhen comparing AJP secret i ... |
| FIXED | LOW | CVE-2026-43514 | org.apache.tomcat:tomcat | 10.1.43 | 9.0.118, 10.1.55, 11.0.22 | distro/tomcat/assembly/pom.xml | Observable Timing Discrepancy vulnerabilitywhen comparing AJP secret i ... |
| CONTINUED | CRITICAL | CVE-2016-1000027 | org.springframework:spring-web | 5.3.39 | 6.0.0 | qa/integration-tests-engine/pom.xml | spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization |
| CONTINUED | CRITICAL | CVE-2026-25896 | fast-xml-parser | 4.5.3 | 5.3.5, 4.5.4 | engine-rest/docs/package-lock.json | fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling |
| CONTINUED | HIGH | CVE-2024-21490 | angular | 1.8.2 | webapps/frontend/package-lock.json | This affects versions of the package angular from 1.3.0. A regular exp ... | |
| CONTINUED | HIGH | CVE-2026-26278 | fast-xml-parser | 4.5.3 | 4.5.4, 5.3.6 | engine-rest/docs/package-lock.json | fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion |
| CONTINUED | HIGH | CVE-2026-26996 | minimatch | 5.1.6 | 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3 | engine-rest/docs/package-lock.json | minimatch: minimatch: Denial of Service via specially crafted glob patterns |
| CONTINUED | HIGH | CVE-2026-27903 | minimatch | 5.1.6 | 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 | engine-rest/docs/package-lock.json | minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns |
| CONTINUED | HIGH | CVE-2026-27904 | minimatch | 5.1.6 | 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 | engine-rest/docs/package-lock.json | minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions |
| CONTINUED | HIGH | CVE-2026-33036 | fast-xml-parser | 4.5.3 | 5.5.6, 4.5.5 | engine-rest/docs/package-lock.json | fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass |
| CONTINUED | HIGH | CVE-2026-42198 | org.postgresql:postgresql | 42.5.5 | 42.7.11 | qa/tomcat-runtime/pom.xml | jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication |
| CONTINUED | HIGH | CVE-2026-42198 | org.postgresql:postgresql | 42.5.5 | 42.7.11 | qa/tomcat9-runtime/pom.xml | jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication |
| CONTINUED | HIGH | CVE-2026-42198 | org.postgresql:postgresql | 42.5.5 | 42.7.11 | qa/wildfly-runtime/pom.xml | jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication |
| CONTINUED | HIGH | CVE-2026-42198 | org.postgresql:postgresql | 42.5.5 | 42.7.11 | qa/wildfly26-runtime/pom.xml | jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication |
| CONTINUED | MEDIUM | CVE-2022-25844 | angular | 1.8.2 | webapps/frontend/package-lock.json | angular: Regular Expression Denial of Service (ReDoS) in angular | |
| CONTINUED | MEDIUM | CVE-2022-25869 | angular | 1.8.2 | webapps/frontend/package-lock.json | angularjs: Angular Cross-site Scripting (XSS) | |
| CONTINUED | MEDIUM | CVE-2023-26116 | angular | 1.8.2 | webapps/frontend/package-lock.json | angularjs: Regular Expression Denial of Service via angular.copy() | |
| CONTINUED | MEDIUM | CVE-2023-26117 | angular | 1.8.2 | webapps/frontend/package-lock.json | angularjs: Regular expression denial of service via the $resource service | |
| CONTINUED | MEDIUM | CVE-2023-26118 | angular | 1.8.2 | webapps/frontend/package-lock.json | angularjs: Regular Expression Denial of Service via the <input type="url"> element | |
| CONTINUED | MEDIUM | CVE-2024-38820 | org.springframework:spring-context | 5.3.39 | 6.1.14 | qa/integration-tests-engine/pom.xml | The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ... |
| CONTINUED | MEDIUM | CVE-2024-38820 | org.springframework:spring-web | 5.3.39 | 6.1.14 | qa/integration-tests-engine/pom.xml | The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ... |
| CONTINUED | MEDIUM | CVE-2024-6485 | bootstrap | 3.4.1 | webapps/frontend/package-lock.json | A security vulnerability has been discovered in bootstrap that could e ... | |
| CONTINUED | MEDIUM | CVE-2025-1647 | bootstrap | 3.4.1 | webapps/frontend/package-lock.json | Improper Neutralization of Input During Web Page Generation (XSS or 'C ... | |
| CONTINUED | MEDIUM | CVE-2025-2336 | angular-sanitize | 1.8.2 | webapps/frontend/package-lock.json | Improper sanitization of the value of the 'href' and 'xlink:href' attr ... | |
| CONTINUED | MEDIUM | CVE-2025-48924 | org.apache.commons:commons-lang3 | 3.12.0 | 3.18.0 | engine-rest/engine-rest-openapi-generator/pom.xml | Uncontrolled Recursion vulnerability in Apache Commons Lang. This iss ... |
| CONTINUED | MEDIUM | CVE-2025-48924 | org.apache.commons:commons-lang3 | 3.12.0 | 3.18.0 | engine-rest/pom.xml | Uncontrolled Recursion vulnerability in Apache Commons Lang. This iss ... |
| CONTINUED | MEDIUM | CVE-2025-64718 | js-yaml | 4.1.0 | 4.1.1, 3.14.2 | engine-rest/docs/package-lock.json | js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1. ... |
| CONTINUED | MEDIUM | CVE-2026-33349 | fast-xml-parser | 4.5.3 | 4.5.5, 5.5.7 | engine-rest/docs/package-lock.json | fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling |
| CONTINUED | MEDIUM | CVE-2026-33532 | yaml | 1.10.2 | 2.8.3, 1.10.3 | engine-rest/docs/package-lock.json | yaml: yaml: Denial of Service via deeply nested YAML document parsing |
| CONTINUED | MEDIUM | CVE-2026-33750 | brace-expansion | 2.0.1 | 5.0.5, 3.0.2, 2.0.3, 1.1.13 | engine-rest/docs/package-lock.json | brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern |
| CONTINUED | MEDIUM | CVE-2026-41305 | postcss | 8.4.49 | 8.5.10 | engine-rest/docs/package-lock.json | postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags |
| CONTINUED | MEDIUM | CVE-2026-41650 | fast-xml-parser | 4.5.3 | 5.7.0 | engine-rest/docs/package-lock.json | fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences |
| CONTINUED | LOW | CVE-2024-8372 | angular | 1.8.2 | webapps/frontend/package-lock.json | Improper sanitization of the value of the 'srcset' attribute in Angula ... | |
| CONTINUED | LOW | CVE-2024-8373 | angular | 1.8.2 | webapps/frontend/package-lock.json | Improper sanitization of the value of the [srcset] attribute in <sourc ... | |
| CONTINUED | LOW | CVE-2025-0716 | angular | 1.8.2 | webapps/frontend/package-lock.json | Improper sanitization of the value of the 'href' and 'xlink:href' attr ... | |
| CONTINUED | LOW | CVE-2025-22233 | org.springframework:spring-context | 5.3.39 | 6.2.7, 6.1.20 | qa/integration-tests-engine/pom.xml | CVE-2024-38820 ensured Locale-independent, lowercase conversion for bo ... |
| CONTINUED | LOW | CVE-2025-5889 | brace-expansion | 2.0.1 | 2.0.2, 1.1.12, 3.0.1, 4.0.1 | engine-rest/docs/package-lock.json | A vulnerability was found in juliangruber brace-expansion up to 1.1.11 ... |
| CONTINUED | LOW | CVE-2026-27942 | fast-xml-parser | 4.5.3 | 5.3.8, 4.5.4 | engine-rest/docs/package-lock.json | fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service |
| NEW | CRITICAL | CVE-2019-10202 | org.codehaus.jackson:jackson-mapper-asl | 1.9.13 | qa/performance-tests-engine/pom.xml | codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities | |
| NEW | CRITICAL | CVE-2026-41293 | org.apache.tomcat:tomcat | 10.1.54 | 9.0.118, 10.1.55, 11.0.22 | distro/tomcat/assembly/pom.xml | Improper Input Validation vulnerability in Apache Tomcat. This issue ... |
| NEW | CRITICAL | CVE-2026-43512 | org.apache.tomcat:tomcat | 10.1.54 | 9.0.118, 10.1.55, 11.0.22 | distro/tomcat/assembly/pom.xml | DEPRECATED: Authentication Bypass Issues vulnerability in digest authe ... |
| NEW | CRITICAL | CVE-2026-43515 | org.apache.tomcat:tomcat | 10.1.54 | 9.0.118, 10.1.55, 11.0.22 | distro/tomcat/assembly/pom.xml | Improper Authorization vulnerability when multiple method constraints ... |
| NEW | HIGH | CVE-2019-10172 | org.codehaus.jackson:jackson-mapper-asl | 1.9.13 | qa/performance-tests-engine/pom.xml | jackson-mapper-asl: XML external entity similar to CVE-2016-3720 | |
| NEW | HIGH | CVE-2026-33036 | fast-xml-parser | 5.4.2 | 5.5.6, 4.5.5 | webapps/frontend/package-lock.json | fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass |
| NEW | HIGH | CVE-2026-41284 | org.apache.tomcat:tomcat | 10.1.54 | 9.0.118, 10.1.55, 11.0.22 | distro/tomcat/assembly/pom.xml | Allocation of Resources Without Limits or Throttling vulnerability in ... |
| NEW | HIGH | CVE-2026-42498 | org.apache.tomcat:tomcat | 10.1.54 | 9.0.118, 10.1.55, 11.0.22 | distro/tomcat/assembly/pom.xml | Exposure of HTTP Authentication Header to unexpected hosts during WebS ... |
| NEW | HIGH | CVE-2026-43513 | org.apache.tomcat:tomcat | 10.1.54 | 9.0.118, 10.1.55, 11.0.22 | distro/tomcat/assembly/pom.xml | Improper Handling of Case Sensitivity vulnerability in LockOutRealm in ... |
| NEW | HIGH | CVE-2026-44665 | fast-xml-builder | 1.0.0 | 1.1.7 | webapps/frontend/package-lock.json | fast-xml-builder: fast-xml-builder: Attribute injection leading to information disclosure or content manipulation |
| NEW | MEDIUM | CVE-2026-33349 | fast-xml-parser | 5.4.2 | 4.5.5, 5.5.7 | webapps/frontend/package-lock.json | fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling |
| NEW | MEDIUM | CVE-2026-41650 | fast-xml-parser | 5.4.2 | 5.7.0 | webapps/frontend/package-lock.json | fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences |
| NEW | MEDIUM | CVE-2026-8723 | qs | 6.15.0 | 6.15.2 | webapps/frontend/package-lock.json | ### Summary `qs.stringify` throws `TypeError` when called with `arr ... |
| NEW | LOW | CVE-2026-43514 | org.apache.tomcat:tomcat | 10.1.54 | 9.0.118, 10.1.55, 11.0.22 | distro/tomcat/assembly/pom.xml | Observable Timing Discrepancy vulnerabilitywhen comparing AJP secret i ... |
Detailed Descriptions
CVE-2016-1000027 - org.springframework:spring-web
Status: CONTINUED
Severity: CRITICAL
Installed Version: 5.3.39
Fixed Version: 6.0.0
Target: qa/integration-tests-engine/pom.xml
Title: spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
Description:
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
Reference: https://avd.aquasec.com/nvd/cve-2016-1000027
CVE-2026-25896 - fast-xml-parser
Status: CONTINUED
Severity: CRITICAL
Installed Version: 4.5.3
Fixed Version: 5.3.5, 4.5.4
Target: engine-rest/docs/package-lock.json
Title: fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling
Description:
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.
Reference: https://avd.aquasec.com/nvd/cve-2026-25896
CVE-2024-21490 - angular
Status: CONTINUED
Severity: HIGH
Installed Version: 1.8.2
Fixed Version:
Target: webapps/frontend/package-lock.json
Title: This affects versions of the package angular from 1.3.0. A regular exp ...
Description:
This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service.
**Note:**
This package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).
Reference: https://avd.aquasec.com/nvd/cve-2024-21490
CVE-2026-26278 - fast-xml-parser
Status: CONTINUED
Severity: HIGH
Installed Version: 4.5.3
Fixed Version: 4.5.4, 5.3.6
Target: engine-rest/docs/package-lock.json
Title: fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion
Description:
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.
Reference: https://avd.aquasec.com/nvd/cve-2026-26278
CVE-2026-26996 - minimatch
Status: CONTINUED
Severity: HIGH
Installed Version: 5.1.6
Fixed Version: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3
Target: engine-rest/docs/package-lock.json
Title: minimatch: minimatch: Denial of Service via specially crafted glob patterns
Description:
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
Reference: https://avd.aquasec.com/nvd/cve-2026-26996
CVE-2026-27903 - minimatch
Status: CONTINUED
Severity: HIGH
Installed Version: 5.1.6
Fixed Version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3
Target: engine-rest/docs/package-lock.json
Title: minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
Description:
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.
Reference: https://avd.aquasec.com/nvd/cve-2026-27903
CVE-2026-27904 - minimatch
Status: CONTINUED
Severity: HIGH
Installed Version: 5.1.6
Fixed Version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4
Target: engine-rest/docs/package-lock.json
Title: minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
Description:
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
Reference: https://avd.aquasec.com/nvd/cve-2026-27904
CVE-2026-33036 - fast-xml-parser
Status: CONTINUED
Severity: HIGH
Installed Version: 4.5.3
Fixed Version: 5.5.6, 4.5.5
Target: engine-rest/docs/package-lock.json
Title: fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass
Description:
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely evade the entity expansion limits (e.g., maxTotalExpansions, maxExpandedLength) added to fix CVE-2026-26278, enabling XML entity expansion Denial of Service. The root cause is that replaceEntitiesValue() in OrderedObjParser.js only enforces expansion counting on DOCTYPE-defined entities while the lastEntities loop handling numeric/standard entities performs no counting at all. An attacker supplying 1M numeric entity references like A can force ~147MB of memory allocation and heavy CPU usage, potentially crashing the process—even when developers have configured strict limits. This issue has been fixed in version 5.5.6.
Reference: https://avd.aquasec.com/nvd/cve-2026-33036
CVE-2026-42198 - org.postgresql:postgresql
Status: CONTINUED
Severity: HIGH
Installed Version: 42.5.5
Fixed Version: 42.7.11
Target: qa/tomcat-runtime/pom.xml
Title: jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication
Description:
pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.
Reference: https://avd.aquasec.com/nvd/cve-2026-42198
CVE-2026-42198 - org.postgresql:postgresql
Status: CONTINUED
Severity: HIGH
Installed Version: 42.5.5
Fixed Version: 42.7.11
Target: qa/tomcat9-runtime/pom.xml
Title: jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication
Description:
pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.
Reference: https://avd.aquasec.com/nvd/cve-2026-42198
CVE-2026-42198 - org.postgresql:postgresql
Status: CONTINUED
Severity: HIGH
Installed Version: 42.5.5
Fixed Version: 42.7.11
Target: qa/wildfly-runtime/pom.xml
Title: jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication
Description:
pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.
Reference: https://avd.aquasec.com/nvd/cve-2026-42198
CVE-2026-42198 - org.postgresql:postgresql
Status: CONTINUED
Severity: HIGH
Installed Version: 42.5.5
Fixed Version: 42.7.11
Target: qa/wildfly26-runtime/pom.xml
Title: jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication
Description:
pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11.
Reference: https://avd.aquasec.com/nvd/cve-2026-42198
CVE-2022-25844 - angular
Status: CONTINUED
Severity: MEDIUM
Installed Version: 1.8.2
Fixed Version:
Target: webapps/frontend/package-lock.json
Title: angular: Regular Expression Denial of Service (ReDoS) in angular
Description:
The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. **Note:** 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.
Reference: https://avd.aquasec.com/nvd/cve-2022-25844
CVE-2022-25869 - angular
Status: CONTINUED
Severity: MEDIUM
Installed Version: 1.8.2
Fixed Version:
Target: webapps/frontend/package-lock.json
Title: angularjs: Angular Cross-site Scripting (XSS)
Description:
All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.
Reference: https://avd.aquasec.com/nvd/cve-2022-25869
CVE-2023-26116 - angular
Status: CONTINUED
Severity: MEDIUM
Installed Version: 1.8.2
Fixed Version:
Target: webapps/frontend/package-lock.json
Title: angularjs: Regular Expression Denial of Service via angular.copy()
Description:
Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.
Reference: https://avd.aquasec.com/nvd/cve-2023-26116
CVE-2023-26117 - angular
Status: CONTINUED
Severity: MEDIUM
Installed Version: 1.8.2
Fixed Version:
Target: webapps/frontend/package-lock.json
Title: angularjs: Regular expression denial of service via the $resource service
Description:
Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.
Reference: https://avd.aquasec.com/nvd/cve-2023-26117
CVE-2023-26118 - angular
Status: CONTINUED
Severity: MEDIUM
Installed Version: 1.8.2
Fixed Version:
Target: webapps/frontend/package-lock.json
Title: angularjs: Regular Expression Denial of Service via the <input type="url"> element
Description:
Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.
Reference: https://avd.aquasec.com/nvd/cve-2023-26118
CVE-2024-38820 - org.springframework:spring-context
Status: CONTINUED
Severity: MEDIUM
Installed Version: 5.3.39
Fixed Version: 6.1.14
Target: qa/integration-tests-engine/pom.xml
Title: The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...
Description:
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
Reference: https://avd.aquasec.com/nvd/cve-2024-38820
CVE-2024-38820 - org.springframework:spring-web
Status: CONTINUED
Severity: MEDIUM
Installed Version: 5.3.39
Fixed Version: 6.1.14
Target: qa/integration-tests-engine/pom.xml
Title: The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...
Description:
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
Reference: https://avd.aquasec.com/nvd/cve-2024-38820
CVE-2024-6485 - bootstrap
Status: CONTINUED
Severity: MEDIUM
Installed Version: 3.4.1
Fixed Version:
Target: webapps/frontend/package-lock.json
Title: A security vulnerability has been discovered in bootstrap that could e ...
Description:
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
Reference: https://avd.aquasec.com/nvd/cve-2024-6485
CVE-2025-1647 - bootstrap
Status: CONTINUED
Severity: MEDIUM
Installed Version: 3.4.1
Fixed Version:
Target: webapps/frontend/package-lock.json
Title: Improper Neutralization of Input During Web Page Generation (XSS or 'C ...
Description:
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.
Reference: https://avd.aquasec.com/nvd/cve-2025-1647
CVE-2025-2336 - angular-sanitize
Status: CONTINUED
Severity: MEDIUM
Installed Version: 1.8.2
Fixed Version:
Target: webapps/frontend/package-lock.json
Title: Improper sanitization of the value of the 'href' and 'xlink:href' attr ...
Description:
Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively affect the application's performance and behavior by using too large or slow-to-load images.
This issue affects AngularJS versions greater than or equal to 1.3.1.
Note:
The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Reference: https://avd.aquasec.com/nvd/cve-2025-2336
CVE-2025-48924 - org.apache.commons:commons-lang3
Status: CONTINUED
Severity: MEDIUM
Installed Version: 3.12.0
Fixed Version: 3.18.0
Target: engine-rest/engine-rest-openapi-generator/pom.xml
Title: Uncontrolled Recursion vulnerability in Apache Commons Lang. This iss ...
Description:
Uncontrolled Recursion vulnerability in Apache Commons Lang.
This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.
The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a
StackOverflowError could cause an application to stop.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Reference: https://avd.aquasec.com/nvd/cve-2025-48924
CVE-2025-48924 - org.apache.commons:commons-lang3
Status: CONTINUED
Severity: MEDIUM
Installed Version: 3.12.0
Fixed Version: 3.18.0
Target: engine-rest/pom.xml
Title: Uncontrolled Recursion vulnerability in Apache Commons Lang. This iss ...
Description:
Uncontrolled Recursion vulnerability in Apache Commons Lang.
This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.
The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a
StackOverflowError could cause an application to stop.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Reference: https://avd.aquasec.com/nvd/cve-2025-48924
CVE-2025-64718 - js-yaml
Status: CONTINUED
Severity: MEDIUM
Installed Version: 4.1.0
Fixed Version: 4.1.1, 3.14.2
Target: engine-rest/docs/package-lock.json
Title: js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1. ...
Description:
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).
Reference: https://avd.aquasec.com/nvd/cve-2025-64718
CVE-2026-33349 - fast-xml-parser
Status: CONTINUED
Severity: MEDIUM
Installed Version: 4.5.3
Fixed Version: 4.5.5, 5.5.7
Target: engine-rest/docs/package-lock.json
Title: fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling
Description:
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.
Reference: https://avd.aquasec.com/nvd/cve-2026-33349
CVE-2026-33532 - yaml
Status: CONTINUED
Severity: MEDIUM
Installed Version: 1.10.2
Fixed Version: 2.8.3, 1.10.3
Target: engine-rest/docs/package-lock.json
Title: yaml: yaml: Denial of Service via deeply nested YAML document parsing
Description:
`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a `RangeError: Maximum call stack size exceeded` with a small payload (~2–10 KB). The `RangeError` is not a `YAMLParseError`, so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process. Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one `[` and one `]`). On the default Node.js stack, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation). Note: the library's `Parser` (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion. All three public parsing APIs are affected: `YAML.parse()`, `YAML.parseDocument()`, and `YAML.parseAllDocuments()`. Versions 1.10.3 and 2.8.3 contain a patch.
Reference: https://avd.aquasec.com/nvd/cve-2026-33532
CVE-2026-33750 - brace-expansion
Status: CONTINUED
Severity: MEDIUM
Installed Version: 2.0.1
Fixed Version: 5.0.5, 3.0.2, 2.0.3, 1.1.13
Target: engine-rest/docs/package-lock.json
Title: brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern
Description:
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.
Reference: https://avd.aquasec.com/nvd/cve-2026-33750
CVE-2026-41305 - postcss
Status: CONTINUED
Severity: MEDIUM
Installed Version: 8.4.49
Fixed Version: 8.5.10
Target: engine-rest/docs/package-lock.json
Title: postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags
Description:
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.
Reference: https://avd.aquasec.com/nvd/cve-2026-41305
CVE-2026-41650 - fast-xml-parser
Status: CONTINUED
Severity: MEDIUM
Installed Version: 4.5.3
Fixed Version: 5.7.0
Target: engine-rest/docs/package-lock.json
Title: fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences
Description:
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.
Reference: https://avd.aquasec.com/nvd/cve-2026-41650
CVE-2024-8372 - angular
Status: CONTINUED
Severity: LOW
Installed Version: 1.8.2
Fixed Version:
Target: webapps/frontend/package-lock.json
Title: Improper sanitization of the value of the 'srcset' attribute in Angula ...
Description:
Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .
This issue affects AngularJS versions 1.3.0-rc.4 and greater.
Note:
The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Reference: https://avd.aquasec.com/nvd/cve-2024-8372
CVE-2024-8373 - angular
Status: CONTINUED
Severity: LOW
Installed Version: 1.8.2
Fixed Version:
Target: webapps/frontend/package-lock.json
Title: Improper sanitization of the value of the [srcset] attribute in <sourc ...
Description:
Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .
This issue affects all versions of AngularJS.
Note:
The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Reference: https://avd.aquasec.com/nvd/cve-2024-8373
CVE-2025-0716 - angular
Status: CONTINUED
Severity: LOW
Installed Version: 1.8.2
Fixed Version:
Target: webapps/frontend/package-lock.json
Title: Improper sanitization of the value of the 'href' and 'xlink:href' attr ...
Description:
Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively affect the application's performance and behavior by using too large or slow-to-load images.
This issue affects all versions of AngularJS.
Note:
The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Reference: https://avd.aquasec.com/nvd/cve-2025-0716
CVE-2025-22233 - org.springframework:spring-context
Status: CONTINUED
Severity: LOW
Installed Version: 5.3.39
Fixed Version: 6.2.7, 6.1.20
Target: qa/integration-tests-engine/pom.xml
Title: CVE-2024-38820 ensured Locale-independent, lowercase conversion for bo ...
Description:
CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks.
Affected Spring Products and Versions
Spring Framework:
* 6.2.0 - 6.2.6
* 6.1.0 - 6.1.19
* 6.0.0 - 6.0.27
* 5.3.0 - 5.3.42
* Older, unsupported versions are also affected
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
Affected version(s)Fix Version Availability 6.2.x
6.2.7
OSS6.1.x
6.1.20
OSS6.0.x
6.0.28
Commercial https://enterprise.spring.io/ 5.3.x
5.3.43
Commercial https://enterprise.spring.io/
No further mitigation steps are necessary.
Generally, we recommend using a dedicated model object with properties only for data binding, or using constructor binding since constructor arguments explicitly declare what to bind together with turning off setter binding through the declarativeBinding flag. See the Model Design section in the reference documentation.
For setting binding, prefer the use of allowedFields (an explicit list) over disallowedFields.
Credit
This issue was responsibly reported by the TERASOLUNA Framework Development Team from NTT DATA Group Corporation.
Reference: https://avd.aquasec.com/nvd/cve-2025-22233
CVE-2025-5889 - brace-expansion
Status: CONTINUED
Severity: LOW
Installed Version: 2.0.1
Fixed Version: 2.0.2, 1.1.12, 3.0.1, 4.0.1
Target: engine-rest/docs/package-lock.json
Title: A vulnerability was found in juliangruber brace-expansion up to 1.1.11 ...
Description:
A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.
Reference: https://avd.aquasec.com/nvd/cve-2025-5889
CVE-2026-27942 - fast-xml-parser
Status: CONTINUED
Severity: LOW
Installed Version: 4.5.3
Fixed Version: 5.3.8, 4.5.4
Target: engine-rest/docs/package-lock.json
Title: fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service
Description:
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.
Reference: https://avd.aquasec.com/nvd/cve-2026-27942
CVE-2019-10202 - org.codehaus.jackson:jackson-mapper-asl
Status: NEW
Severity: CRITICAL
Installed Version: 1.9.13
Fixed Version:
Target: qa/performance-tests-engine/pom.xml
Title: codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities
Description:
A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.
Reference: https://avd.aquasec.com/nvd/cve-2019-10202
CVE-2026-41293 - org.apache.tomcat:tomcat
Status: NEW
Severity: CRITICAL
Installed Version: 10.1.54
Fixed Version: 9.0.118, 10.1.55, 11.0.22
Target: distro/tomcat/assembly/pom.xml
Title: Improper Input Validation vulnerability in Apache Tomcat. This issue ...
Description:
Improper Input Validation vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.
Older, end of support versions may also be affected.
Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
Reference: https://avd.aquasec.com/nvd/cve-2026-41293
CVE-2026-43512 - org.apache.tomcat:tomcat
Status: NEW
Severity: CRITICAL
Installed Version: 10.1.54
Fixed Version: 9.0.118, 10.1.55, 11.0.22
Target: distro/tomcat/assembly/pom.xml
Title: DEPRECATED: Authentication Bypass Issues vulnerability in digest authe ...
Description:
DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.
Older unsupported versions any also be affect
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
Reference: https://avd.aquasec.com/nvd/cve-2026-43512
CVE-2026-43515 - org.apache.tomcat:tomcat
Status: NEW
Severity: CRITICAL
Installed Version: 10.1.54
Fixed Version: 9.0.118, 10.1.55, 11.0.22
Target: distro/tomcat/assembly/pom.xml
Title: Improper Authorization vulnerability when multiple method constraints ...
Description:
Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
Reference: https://avd.aquasec.com/nvd/cve-2026-43515
CVE-2019-10172 - org.codehaus.jackson:jackson-mapper-asl
Status: NEW
Severity: HIGH
Installed Version: 1.9.13
Fixed Version:
Target: qa/performance-tests-engine/pom.xml
Title: jackson-mapper-asl: XML external entity similar to CVE-2016-3720
Description:
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
Reference: https://avd.aquasec.com/nvd/cve-2019-10172
CVE-2026-33036 - fast-xml-parser
Status: NEW
Severity: HIGH
Installed Version: 5.4.2
Fixed Version: 5.5.6, 4.5.5
Target: webapps/frontend/package-lock.json
Title: fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass
Description:
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely evade the entity expansion limits (e.g., maxTotalExpansions, maxExpandedLength) added to fix CVE-2026-26278, enabling XML entity expansion Denial of Service. The root cause is that replaceEntitiesValue() in OrderedObjParser.js only enforces expansion counting on DOCTYPE-defined entities while the lastEntities loop handling numeric/standard entities performs no counting at all. An attacker supplying 1M numeric entity references like A can force ~147MB of memory allocation and heavy CPU usage, potentially crashing the process—even when developers have configured strict limits. This issue has been fixed in version 5.5.6.
Reference: https://avd.aquasec.com/nvd/cve-2026-33036
CVE-2026-41284 - org.apache.tomcat:tomcat
Status: NEW
Severity: HIGH
Installed Version: 10.1.54
Fixed Version: 9.0.118, 10.1.55, 11.0.22
Target: distro/tomcat/assembly/pom.xml
Title: Allocation of Resources Without Limits or Throttling vulnerability in ...
Description:
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117.
Older, unsupported versions may also be affected.
Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
Reference: https://avd.aquasec.com/nvd/cve-2026-41284
CVE-2026-42498 - org.apache.tomcat:tomcat
Status: NEW
Severity: HIGH
Installed Version: 10.1.54
Fixed Version: 9.0.118, 10.1.55, 11.0.22
Target: distro/tomcat/assembly/pom.xml
Title: Exposure of HTTP Authentication Header to unexpected hosts during WebS ...
Description:
Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.
Reference: https://avd.aquasec.com/nvd/cve-2026-42498
CVE-2026-43513 - org.apache.tomcat:tomcat
Status: NEW
Severity: HIGH
Installed Version: 10.1.54
Fixed Version: 9.0.118, 10.1.55, 11.0.22
Target: distro/tomcat/assembly/pom.xml
Title: Improper Handling of Case Sensitivity vulnerability in LockOutRealm in ...
Description:
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Older unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
Reference: https://avd.aquasec.com/nvd/cve-2026-43513
CVE-2026-44665 - fast-xml-builder
Status: NEW
Severity: HIGH
Installed Version: 1.0.0
Fixed Version: 1.1.7
Target: webapps/frontend/package-lock.json
Title: fast-xml-builder: fast-xml-builder: Attribute injection leading to information disclosure or content manipulation
Description:
fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML. This vulnerability is fixed in 1.1.7.
Reference: https://avd.aquasec.com/nvd/cve-2026-44665
CVE-2026-33349 - fast-xml-parser
Status: NEW
Severity: MEDIUM
Installed Version: 5.4.2
Fixed Version: 4.5.5, 5.5.7
Target: webapps/frontend/package-lock.json
Title: fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling
Description:
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.
Reference: https://avd.aquasec.com/nvd/cve-2026-33349
CVE-2026-41650 - fast-xml-parser
Status: NEW
Severity: MEDIUM
Installed Version: 5.4.2
Fixed Version: 5.7.0
Target: webapps/frontend/package-lock.json
Title: fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences
Description:
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.
Reference: https://avd.aquasec.com/nvd/cve-2026-41650
CVE-2026-8723 - qs
Status: NEW
Severity: MEDIUM
Installed Version: 6.15.0
Fixed Version: 6.15.2
Target: webapps/frontend/package-lock.json
Title: ### Summary `qs.stringify` throws `TypeError` when called with `arr ...
Description:
### Summary
`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).
### Details
In the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:
```js
obj = utils.maybeMap(obj, encoder);
```
`utils.encode` (`lib/utils.js:195`) reads `str.length` with no null guard, so a `null` or `undefined` element throws `TypeError`. `skipNulls` and `strictNullHandling` are both checked in the per-element loop below this line and never get a chance to run.
Same class of bug as the filter-array path fixed in 0c180a4. The vulnerable shape of the comma + `encodeValuesOnly` branch was introduced in 4c4b23d ("encode comma values more consistently", PR #463, 2023-01-19), first released in v6.11.1.
#### PoC
```js
const qs = require('qs');
qs.stringify({ a: [null, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true });
qs.stringify({ a: [undefined, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true });
qs.stringify({ a: [null] }, { arrayFormat: 'comma', encodeValuesOnly: true });
// TypeError: Cannot read properties of null (reading 'length')
// at encode (lib/utils.js:195:13)
// at Object.maybeMap (lib/utils.js:322:37)
// at stringify (lib/stringify.js:145:25)
```
#### Fix
`lib/stringify.js:145`, applied in 21f80b3 on `main` and released as v6.15.2:
```diff
- obj = utils.maybeMap(obj, encoder);
+ obj = utils.maybeMap(obj, function (v) {
+ return v == null ? v : encoder(v);
+ });
```
`null` and `undefined` now pass through `maybeMap` unchanged and reach the `join(',')` step as-is. For `{ a: [null, 'b'] }` this produces `a=,b`, matching the non-`encodeValuesOnly` comma path (which already joins before encoding and produces `a=%2Cb` for the same input). Single-element `[null]` arrays still collapse via the existing `obj.join(',') || null` and remain subject to `skipNulls` / `strictNullHandling` in the main loop.
### Affected versions
`>=6.11.1 <6.15.2` — fixed in v6.15.2.
The vulnerable code shape was introduced in 4c4b23d and first shipped in v6.11.1. Earlier versions — including all of 6.7.x, 6.8.x, 6.9.x, 6.10.x, and 6.11.0 — implemented the comma + `encodeValuesOnly` path differently (joining before encoding) and are not affected. Empirically verified across released versions.
### Impact
Application code that calls `qs.stringify` with both `arrayFormat: 'comma'` and `encodeValuesOnly: true` (both non-default) on input that may contain a `null` or `undefined` array element will throw synchronously instead of producing a query string. In a typical Node.js HTTP framework (Express, Fastify, Koa, hapi) the sync throw is caught by the framework's error boundary and the affected request returns a 500; the worker process does not exit and subsequent requests are unaffected. The "kills the worker process" framing applies only to call sites outside a request-handler error boundary (background jobs, startup paths, stream pipelines) or to deployments with framework error handling explicitly disabled.
The vulnerable input is a `null` or `undefined` entry inside an array; this is reachable from JSON request bodies or from application code constructing arrays from user input, but not from standard HTML form submissions (which produce strings or omitted fields, not literal `null`).
Reference: https://avd.aquasec.com/nvd/cve-2026-8723
CVE-2026-43514 - org.apache.tomcat:tomcat
Status: NEW
Severity: LOW
Installed Version: 10.1.54
Fixed Version: 9.0.118, 10.1.55, 11.0.22
Target: distro/tomcat/assembly/pom.xml
Title: Observable Timing Discrepancy vulnerabilitywhen comparing AJP secret i ...
Description:
Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Older unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
Reference: https://avd.aquasec.com/nvd/cve-2026-43514