Generated 2026-06-29T15:42:33Z
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| high | CVE-2026-40983 | SNYK-JAVA-IOMICROMETER-17339194 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-09 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 7.0.7 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 7.0.7 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 7.0.7 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.15.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.15.2 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.15.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.22.0 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.4.0 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.4.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.4.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.4.0 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.4.0 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.4.0 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.4.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.1 | Inefficient Algorithmic Complexity | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.5 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 7.0.7 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 7.0.7 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 7.0.7 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 7.0.7 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 7.0.7 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 7.0.7 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.15.2 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.15.2 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.15.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.15.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44489 | SNYK-JS-AXIOS-17111086 | axios | 1.15.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.4.0 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
Previous release was affected, but this one is not.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed |
|---|---|---|---|---|---|---|
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.2.13.Final | Improper Verification of Cryptographic Signature | 2026-06-12 |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 7.0.5 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 7.0.5 | Cross-site Scripting (XSS) | 2026-06-10 |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 8.4.0 | Cross-site Scripting (XSS) | 2026-05-28 |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 8.4.0 | Cross-site Scripting (XSS) | 2026-05-28 |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 8.4.0 | Cross-site Scripting (XSS) | 2026-05-28 |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.2.13.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 9.2.2 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 7.0.5 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 9.2.2 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 7.0.5 | Cross-site Scripting (XSS) | 2026-06-10 | 9.2.2 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 8.4.0 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 8.4.0 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 8.4.0 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incomplete List of Disallowed Inputs | 2026-06-23 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Deserialization of Untrusted Data | 2026-06-23 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.2.13.Final | Incorrect Comparison | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.14.1 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40983 | SNYK-JAVA-IOMICROMETER-17339194 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-09 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-40993 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17304906 | org.springframework.security:spring-security-saml2-service-provider | 7.0.5 | Deserialization of Untrusted Data | 2026-06-09 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.2.13.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 7.0.7 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 7.0.7 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 7.0.7 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 4.0.3 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.15.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.14.1 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.15.2 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.15.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Server-side Request Forgery (SSRF) | 2026-06-23 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54517 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440307 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incorrect Authorization | 2026-06-23 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54518 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440360 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incorrect Authorization | 2026-06-23 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54516 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457397 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.4.0 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.4.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.4.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.4.0 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.4.0 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.4.0 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.4.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.1 | Inefficient Algorithmic Complexity | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.2.13.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.2.13.Final | HTTP Request Smuggling | 2026-06-12 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.5 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.2.13.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 9.2.2 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 7.0.5 | Open Redirect | 2026-06-10 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 7.0.5 | Information Exposure | 2026-06-09 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.2.13.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.2.13.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 7.0.7 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 7.0.7 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 7.0.7 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 7.0.7 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 7.0.7 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 7.0.7 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.15.2 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.15.2 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.15.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.15.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44489 | SNYK-JS-AXIOS-17111086 | axios | 1.15.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.4.0 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-53663 | SNYK-JS-REACTROUTER-17342510 | react-router | 7.14.1 | Cross-site Request Forgery (CSRF) | 2026-06-15 | 9.2.2 | vulnerable_code_not_in_execute_path |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.2.13.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 9.2.2 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 7.0.5 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 9.2.2 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 7.0.5 | Cross-site Scripting (XSS) | 2026-06-10 | 9.2.2 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 8.4.0 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 8.4.0 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 8.4.0 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incomplete List of Disallowed Inputs | 2026-06-23 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Deserialization of Untrusted Data | 2026-06-23 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.2.13.Final | Incorrect Comparison | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.14.1 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40983 | SNYK-JAVA-IOMICROMETER-17339194 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-09 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-40993 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17304906 | org.springframework.security:spring-security-saml2-service-provider | 7.0.5 | Deserialization of Untrusted Data | 2026-06-09 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.2.13.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 7.0.7 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 7.0.7 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 7.0.7 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 4.0.3 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.15.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.14.1 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.15.2 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.15.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Server-side Request Forgery (SSRF) | 2026-06-23 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54517 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440307 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incorrect Authorization | 2026-06-23 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54518 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440360 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incorrect Authorization | 2026-06-23 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54516 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457397 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.4.0 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.4.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.4.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.4.0 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.4.0 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.4.0 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.4.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.1 | Inefficient Algorithmic Complexity | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.2.13.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.2.13.Final | HTTP Request Smuggling | 2026-06-12 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.5 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.2.13.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 9.2.2 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 7.0.5 | Open Redirect | 2026-06-10 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 7.0.5 | Information Exposure | 2026-06-09 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.2.13.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.2.13.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 7.0.7 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 7.0.7 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 7.0.7 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 7.0.7 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 7.0.7 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 7.0.7 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.15.2 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.15.2 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.15.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.15.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44489 | SNYK-JS-AXIOS-17111086 | axios | 1.15.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-8723 | SNYK-JS-QS-16721866 | qs | 6.15.1 | NULL Pointer Dereference | 2026-05-17 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.4.0 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-53663 | SNYK-JS-REACTROUTER-17342510 | react-router | 7.14.1 | Cross-site Request Forgery (CSRF) | 2026-06-15 | 9.2.2 | vulnerable_code_not_in_execute_path |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
Previous release was affected, but this one is not.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed |
|---|---|---|---|---|---|---|
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.11 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.13.6 | HTTP Response Splitting | 2026-04-10 |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.11 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.13.6 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.12.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.13.6 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.13.6 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.13.6 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.81.1 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40983 | SNYK-JAVA-IOMICROMETER-17339194 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-09 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.18 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.18 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.18 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.16 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.13.6 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.12.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.12.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.12.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.13.6 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.13.6 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.13.6 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.7 | Unsafe Reflection | 2026-05-04 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.7 | XML External Entity (XXE) Injection | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.7 | Memory Allocation with Excessive Size Value | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.13.6 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.13.6 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.81 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.81 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.22.0 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.3.3 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.3.3 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.3.3 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.3.3 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.1 | Inefficient Algorithmic Complexity | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.5 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.18 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.18 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.18 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.18 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.18 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.18 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.13.6 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.13.6 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.13.6 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-33245 | SNYK-JS-REACTROUTER-17137545 | react-router | 7.12.0 | Cross-site Scripting (XSS) | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.13.6 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.13.6 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.13.6 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.13.6 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.13.6 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.13.6 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.13.6 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.13.6 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-40542 | SNYK-JAVA-ORGAPACHEHTTPCOMPONENTSCLIENT5-16134546 | org.apache.httpcomponents.client5:httpclient5 | 5.6 | Missing Critical Step in Authentication | 2026-04-23 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.3.3 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.81 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.13.6 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.3.3 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-53663 | SNYK-JS-REACTROUTER-17342510 | react-router | 7.12.0 | Cross-site Request Forgery (CSRF) | 2026-06-15 | 9.2.2 | vulnerable_code_not_in_execute_path |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
Previous release was affected, but this one is not.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed |
|---|---|---|---|---|---|---|
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.2.12.Final | Improper Verification of Cryptographic Signature | 2026-06-12 |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Cross-site Scripting (XSS) | 2026-06-10 |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.2.12.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.11 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.13.6 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Cross-site Scripting (XSS) | 2026-06-10 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incomplete List of Disallowed Inputs | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Deserialization of Untrusted Data | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.2.12.Final | Incorrect Comparison | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.12.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.13.6 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.13.6 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.13.6 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.81.1 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40983 | SNYK-JAVA-IOMICROMETER-17339194 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-09 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305998 | org.springframework.security:spring-security-web | 6.5.9 | User Impersonation | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305999 | org.springframework.security:spring-security-config | 6.5.9 | User Impersonation | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.2.12.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.18 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.18 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.18 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.16 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.13.6 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.12.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.12.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.12.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.13.6 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.13.6 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.13.6 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42583 | SNYK-JAVA-IONETTY-16438323 | io.netty:netty-codec-compression | 4.2.12.Final | Allocation of Resources Without Limits or Throttling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42585 | SNYK-JAVA-IONETTY-16438737 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42584 | SNYK-JAVA-IONETTY-16438923 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438929 | io.netty:netty-codec-http2 | 4.2.12.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438931 | io.netty:netty-codec-compression | 4.2.12.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42581 | SNYK-JAVA-IONETTY-16438934 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42577 | SNYK-JAVA-IONETTY-16438936 | io.netty:netty-transport-classes-epoll | 4.2.12.Final | Missing Release of Resource after Effective Lifetime | 2026-05-06 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.7 | Unsafe Reflection | 2026-05-04 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.7 | XML External Entity (XXE) Injection | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.7 | Memory Allocation with Excessive Size Value | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.13.6 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.13.6 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.81 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.81 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Server-side Request Forgery (SSRF) | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54517 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440307 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incorrect Authorization | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54518 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440360 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incorrect Authorization | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54516 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457397 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.3.3 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.3.3 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.3.3 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.3.3 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.1 | Inefficient Algorithmic Complexity | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.2.12.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-06-12 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.5 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.2.12.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 9.1.7 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 6.5.9 | Open Redirect | 2026-06-10 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Information Exposure | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.2.12.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.2.12.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.18 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.18 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.18 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.18 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.18 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.18 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.13.6 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.13.6 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.13.6 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-33245 | SNYK-JS-REACTROUTER-17137545 | react-router | 7.12.0 | Cross-site Scripting (XSS) | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.13.6 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-42580 | SNYK-JAVA-IONETTY-16438926 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41417 | SNYK-JAVA-IONETTY-16425695 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-05-05 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.13.6 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.13.6 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.13.6 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.13.6 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.13.6 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.13.6 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.13.6 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-40542 | SNYK-JAVA-ORGAPACHEHTTPCOMPONENTSCLIENT5-16134546 | org.apache.httpcomponents.client5:httpclient5 | 5.6 | Missing Critical Step in Authentication | 2026-04-23 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22746 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121176 | org.springframework.security:spring-security-core | 6.5.9 | Information Exposure | 2026-04-22 | 9.1.7 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22748 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448 | org.springframework.security:spring-security-oauth2-jose | 6.5.9 | Insufficient Verification of Data Authenticity | 2026-04-22 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22751 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16120313 | org.springframework.security:spring-security-core | 6.5.9 | Time-of-check Time-of-use (TOCTOU) Race Condition | 2026-04-21 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.3.3 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.81 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.13.6 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.3.3 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-53663 | SNYK-JS-REACTROUTER-17342510 | react-router | 7.12.0 | Cross-site Request Forgery (CSRF) | 2026-06-15 | 9.2.2 | vulnerable_code_not_in_execute_path |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
Previous release was affected, but this one is not.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed |
|---|---|---|---|---|---|---|
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.2.12.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.11 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.13.6 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Cross-site Scripting (XSS) | 2026-06-10 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 | 9.1.6 | Upgrade to TopBraid EDG 9.1.6 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incomplete List of Disallowed Inputs | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Deserialization of Untrusted Data | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.2.12.Final | Incorrect Comparison | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.12.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.13.6 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.13.6 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.13.6 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.81.1 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40983 | SNYK-JAVA-IOMICROMETER-17339194 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-09 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305998 | org.springframework.security:spring-security-web | 6.5.9 | User Impersonation | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305999 | org.springframework.security:spring-security-config | 6.5.9 | User Impersonation | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.2.12.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.18 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.18 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.18 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.16 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.13.6 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.12.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.12.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.12.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.13.6 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.13.6 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.13.6 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42583 | SNYK-JAVA-IONETTY-16438323 | io.netty:netty-codec-compression | 4.2.12.Final | Allocation of Resources Without Limits or Throttling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42585 | SNYK-JAVA-IONETTY-16438737 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42584 | SNYK-JAVA-IONETTY-16438923 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438929 | io.netty:netty-codec-http2 | 4.2.12.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438931 | io.netty:netty-codec-compression | 4.2.12.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42581 | SNYK-JAVA-IONETTY-16438934 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42577 | SNYK-JAVA-IONETTY-16438936 | io.netty:netty-transport-classes-epoll | 4.2.12.Final | Missing Release of Resource after Effective Lifetime | 2026-05-06 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.7 | Unsafe Reflection | 2026-05-04 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.7 | XML External Entity (XXE) Injection | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.7 | Memory Allocation with Excessive Size Value | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.13.6 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.13.6 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.81 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.81 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Server-side Request Forgery (SSRF) | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54517 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440307 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incorrect Authorization | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54518 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440360 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incorrect Authorization | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54516 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457397 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.3.3 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.3.3 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.3.3 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.3.3 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.0 | Inefficient Algorithmic Complexity | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.2.12.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-06-12 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.5 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.2.12.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 9.1.7 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 6.5.9 | Open Redirect | 2026-06-10 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Information Exposure | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.2.12.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.2.12.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.18 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.18 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.18 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.18 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.18 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.18 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.13.6 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.13.6 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.13.6 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-33245 | SNYK-JS-REACTROUTER-17137545 | react-router | 7.12.0 | Cross-site Scripting (XSS) | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.13.6 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-42580 | SNYK-JAVA-IONETTY-16438926 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41417 | SNYK-JAVA-IONETTY-16425695 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-05-05 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.13.6 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.13.6 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.13.6 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.13.6 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.13.6 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.13.6 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.13.6 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-40542 | SNYK-JAVA-ORGAPACHEHTTPCOMPONENTSCLIENT5-16134546 | org.apache.httpcomponents.client5:httpclient5 | 5.6 | Missing Critical Step in Authentication | 2026-04-23 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22746 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121176 | org.springframework.security:spring-security-core | 6.5.9 | Information Exposure | 2026-04-22 | 9.1.7 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22748 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448 | org.springframework.security:spring-security-oauth2-jose | 6.5.9 | Insufficient Verification of Data Authenticity | 2026-04-22 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22751 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16120313 | org.springframework.security:spring-security-core | 6.5.9 | Time-of-check Time-of-use (TOCTOU) Race Condition | 2026-04-21 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.3.3 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.81 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.13.6 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.3.3 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-53663 | SNYK-JS-REACTROUTER-17342510 | react-router | 7.12.0 | Cross-site Request Forgery (CSRF) | 2026-06-15 | 9.2.2 | vulnerable_code_not_in_execute_path |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
Previous release was affected, but this one is not.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed |
|---|---|---|---|---|---|---|
| high | CVE-2026-34478 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967739 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Output Neutralization for Logs | 2026-04-10 |
| high | CVE-2026-34480 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967769 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Encoding or Escaping of Output | 2026-04-10 |
| high | CVE-2026-34479 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967804 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Encoding or Escaping of Output | 2026-04-10 |
| medium | CVE-2026-34477 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967727 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Validation of Certificate with Host Mismatch | 2026-04-10 |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.2.12.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.11 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-34478 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967739 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Output Neutralization for Logs | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Rfc5424Layout with a stream-based syslog appender should reconfigure to avoid Rfc5424Layout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34480 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967769 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Encoding or Escaping of Output | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use XmlLayout should reconfigure to avoid XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34479 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967804 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Encoding or Escaping of Output | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Log4j1XmlLayout should reconfigure to avoid Log4j1XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.13.6 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Cross-site Scripting (XSS) | 2026-06-10 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-34477 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967727 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Validation of Certificate with Host Mismatch | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use SocketAppender, SmtpAppender, or SyslogAppender with TLS should reconfigure to avoid those appenders, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 | 9.1.6 | Upgrade to TopBraid EDG 9.1.6 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incomplete List of Disallowed Inputs | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Deserialization of Untrusted Data | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.2.12.Final | Incorrect Comparison | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.12.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.13.6 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.13.6 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.13.6 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.81.1 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40983 | SNYK-JAVA-IOMICROMETER-17339194 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-09 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305998 | org.springframework.security:spring-security-web | 6.5.9 | User Impersonation | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305999 | org.springframework.security:spring-security-config | 6.5.9 | User Impersonation | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.2.12.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.17 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.17 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.17 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.16 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.13.6 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.12.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.12.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.12.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.13.6 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.13.6 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.13.6 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42583 | SNYK-JAVA-IONETTY-16438323 | io.netty:netty-codec-compression | 4.2.12.Final | Allocation of Resources Without Limits or Throttling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42585 | SNYK-JAVA-IONETTY-16438737 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42584 | SNYK-JAVA-IONETTY-16438923 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438929 | io.netty:netty-codec-http2 | 4.2.12.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438931 | io.netty:netty-codec-compression | 4.2.12.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42581 | SNYK-JAVA-IONETTY-16438934 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42577 | SNYK-JAVA-IONETTY-16438936 | io.netty:netty-transport-classes-epoll | 4.2.12.Final | Missing Release of Resource after Effective Lifetime | 2026-05-06 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.7 | Unsafe Reflection | 2026-05-04 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.7 | XML External Entity (XXE) Injection | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.7 | Memory Allocation with Excessive Size Value | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.13.6 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.13.6 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-22740 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109615 | org.springframework:spring-web | 6.2.17 | Incomplete Cleanup | 2026-04-17 | 9.1.5 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.81 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.81 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Server-side Request Forgery (SSRF) | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54517 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440307 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incorrect Authorization | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54518 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440360 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incorrect Authorization | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54516 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457397 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.3.3 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.3.3 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.3.3 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.3.3 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.0 | Inefficient Algorithmic Complexity | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.2.12.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-06-12 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.5 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.2.12.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 9.1.7 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 6.5.9 | Open Redirect | 2026-06-10 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Information Exposure | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.2.12.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.2.12.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.17 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.17 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.17 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.17 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.17 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.17 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.13.6 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.13.6 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.13.6 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-33245 | SNYK-JS-REACTROUTER-17137545 | react-router | 7.12.0 | Cross-site Scripting (XSS) | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.13.6 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-42580 | SNYK-JAVA-IONETTY-16438926 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41417 | SNYK-JAVA-IONETTY-16425695 | io.netty:netty-codec-http | 4.2.12.Final | HTTP Request Smuggling | 2026-05-05 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.13.6 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.13.6 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.13.6 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.13.6 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.13.6 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.13.6 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.13.6 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-40542 | SNYK-JAVA-ORGAPACHEHTTPCOMPONENTSCLIENT5-16134546 | org.apache.httpcomponents.client5:httpclient5 | 5.6 | Missing Critical Step in Authentication | 2026-04-23 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22746 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121176 | org.springframework.security:spring-security-core | 6.5.9 | Information Exposure | 2026-04-22 | 9.1.7 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22748 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448 | org.springframework.security:spring-security-oauth2-jose | 6.5.9 | Insufficient Verification of Data Authenticity | 2026-04-22 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22751 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16120313 | org.springframework.security:spring-security-core | 6.5.9 | Time-of-check Time-of-use (TOCTOU) Race Condition | 2026-04-21 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22745 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109618 | org.springframework:spring-core | 6.2.17 | Allocation of Resources Without Limits or Throttling | 2026-04-17 | 9.1.5 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.3.3 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.81 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.13.6 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.3.3 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-53663 | SNYK-JS-REACTROUTER-17342510 | react-router | 7.12.0 | Cross-site Request Forgery (CSRF) | 2026-06-15 | 9.2.2 | vulnerable_code_not_in_execute_path |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
Previous release was affected, but this one is not.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed |
|---|---|---|---|---|---|---|
| high | CVE-2026-4800 | SNYK-JS-LODASH-15869625 | lodash | 4.17.23 | Arbitrary Code Injection | 2026-03-31 |
| high | CVE-2026-4800 | SNYK-JS-LODASHES-15869627 | lodash-es | 4.17.21 | Arbitrary Code Injection | 2026-03-31 |
| high | CVE-2026-33870 | SNYK-JAVA-IONETTY-15789756 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-03-26 |
| high | CVE-2026-33871 | SNYK-JAVA-IONETTY-15789758 | io.netty:netty-codec-http2 | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-03-26 |
| medium | CVE-2026-2950 | SNYK-JS-LODASH-15869619 | lodash | 4.17.23 | Prototype Pollution | 2026-03-31 |
| medium | CVE-2026-2950 | SNYK-JS-LODASHES-15869621 | lodash-es | 4.17.21 | Prototype Pollution | 2026-03-31 |
| medium | CVE-2025-13465 | SNYK-JS-LODASHES-15053836 | lodash-es | 4.17.21 | Prototype Pollution | 2026-01-21 |
| low | CVE-2026-22735 | SNYK-JAVA-ORGSPRINGFRAMEWORK-15701755 | org.springframework:spring-web | 6.2.16 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 2026-03-19 |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.2.9.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.11 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-34478 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967739 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Output Neutralization for Logs | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Rfc5424Layout with a stream-based syslog appender should reconfigure to avoid Rfc5424Layout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34480 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967769 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Encoding or Escaping of Output | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use XmlLayout should reconfigure to avoid XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34479 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967804 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Encoding or Escaping of Output | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Log4j1XmlLayout should reconfigure to avoid Log4j1XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.13.6 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASH-15869625 | lodash | 4.17.23 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASHES-15869627 | lodash-es | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-33870 | SNYK-JAVA-IONETTY-15789756 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-03-26 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-33871 | SNYK-JAVA-IONETTY-15789758 | io.netty:netty-codec-http2 | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-03-26 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Cross-site Scripting (XSS) | 2026-06-10 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-34477 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967727 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Validation of Certificate with Host Mismatch | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use SocketAppender, SmtpAppender, or SyslogAppender with TLS should reconfigure to avoid those appenders, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| medium | CVE-2026-2950 | SNYK-JS-LODASH-15869619 | lodash | 4.17.23 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASHES-15869621 | lodash-es | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASHES-15053836 | lodash-es | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 | 9.1.6 | Upgrade to TopBraid EDG 9.1.6 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| low | CVE-2026-22735 | SNYK-JAVA-ORGSPRINGFRAMEWORK-15701755 | org.springframework:spring-web | 6.2.16 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 2026-03-19 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incomplete List of Disallowed Inputs | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Deserialization of Untrusted Data | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.2.9.Final | Incorrect Comparison | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.12.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.13.6 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.13.6 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.13.6 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.81.1 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40983 | SNYK-JAVA-IOMICROMETER-17339194 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-09 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305998 | org.springframework.security:spring-security-web | 6.5.9 | User Impersonation | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305999 | org.springframework.security:spring-security-config | 6.5.9 | User Impersonation | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.16 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.16 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.16 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.16 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.13.6 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.12.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.12.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.12.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.13.6 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.13.6 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.13.6 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42583 | SNYK-JAVA-IONETTY-16438323 | io.netty:netty-codec-compression | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42585 | SNYK-JAVA-IONETTY-16438737 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42584 | SNYK-JAVA-IONETTY-16438923 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438929 | io.netty:netty-codec-http2 | 4.2.9.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438931 | io.netty:netty-codec-compression | 4.2.9.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42581 | SNYK-JAVA-IONETTY-16438934 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42577 | SNYK-JAVA-IONETTY-16438936 | io.netty:netty-transport-classes-epoll | 4.2.9.Final | Missing Release of Resource after Effective Lifetime | 2026-05-06 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.7 | Unsafe Reflection | 2026-05-04 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.7 | XML External Entity (XXE) Injection | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.7 | Memory Allocation with Excessive Size Value | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.13.6 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.13.6 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-22740 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109615 | org.springframework:spring-web | 6.2.16 | Incomplete Cleanup | 2026-04-17 | 9.1.5 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.81 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.81 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Server-side Request Forgery (SSRF) | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54517 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440307 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incorrect Authorization | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54518 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440360 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Incorrect Authorization | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54516 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457397 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.3.3 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.3.3 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.3.3 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.3.3 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.0 | Inefficient Algorithmic Complexity | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-06-12 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.5 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.2.9.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 9.1.7 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 6.5.9 | Open Redirect | 2026-06-10 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Information Exposure | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.2.9.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.16 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.16 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.16 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.16 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.16 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.16 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.13.6 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.13.6 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.13.6 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-33245 | SNYK-JS-REACTROUTER-17137545 | react-router | 7.12.0 | Cross-site Scripting (XSS) | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.13.6 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-42580 | SNYK-JAVA-IONETTY-16438926 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41417 | SNYK-JAVA-IONETTY-16425695 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-05 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.13.6 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.13.6 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.13.6 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.13.6 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.13.6 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.13.6 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.13.6 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-40542 | SNYK-JAVA-ORGAPACHEHTTPCOMPONENTSCLIENT5-16134546 | org.apache.httpcomponents.client5:httpclient5 | 5.6 | Missing Critical Step in Authentication | 2026-04-23 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22746 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121176 | org.springframework.security:spring-security-core | 6.5.9 | Information Exposure | 2026-04-22 | 9.1.7 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22748 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448 | org.springframework.security:spring-security-oauth2-jose | 6.5.9 | Insufficient Verification of Data Authenticity | 2026-04-22 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22751 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16120313 | org.springframework.security:spring-security-core | 6.5.9 | Time-of-check Time-of-use (TOCTOU) Race Condition | 2026-04-21 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22745 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109618 | org.springframework:spring-core | 6.2.16 | Allocation of Resources Without Limits or Throttling | 2026-04-17 | 9.1.5 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.3.3 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.81 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.13.6 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.3.3 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-53663 | SNYK-JS-REACTROUTER-17342510 | react-router | 7.12.0 | Cross-site Request Forgery (CSRF) | 2026-06-15 | 9.2.2 | vulnerable_code_not_in_execute_path |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.3.3 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
Previous release was affected, but this one is not.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed |
|---|---|---|---|---|---|---|
| critical | CVE-2026-22732 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-15701796 | org.springframework.security:spring-security-web | 6.5.6 | Use of Cache Containing Sensitive Information | 2026-03-20 |
| high | CVE-2026-25639 | SNYK-JS-AXIOS-15252993 | axios | 1.13.2 | Prototype Pollution | 2026-02-09 |
| medium | CVE-2026-0540 | SNYK-JS-DOMPURIFY-15371376 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-03-03 |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-22732 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-15701796 | org.springframework.security:spring-security-web | 6.5.6 | Use of Cache Containing Sensitive Information | 2026-03-20 | 9.1.3 | Upgrade to TopBraid EDG 8.5.3, 9.0.3, 9.1.3, or later, when available. |
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.2.9.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.6 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.9 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-34478 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967739 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Output Neutralization for Logs | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Rfc5424Layout with a stream-based syslog appender should reconfigure to avoid Rfc5424Layout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34480 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967769 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Encoding or Escaping of Output | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use XmlLayout should reconfigure to avoid XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34479 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967804 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Encoding or Escaping of Output | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Log4j1XmlLayout should reconfigure to avoid Log4j1XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.13.2 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASH-15869625 | lodash | 4.17.23 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASHES-15869627 | lodash-es | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-33870 | SNYK-JAVA-IONETTY-15789756 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-03-26 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-33871 | SNYK-JAVA-IONETTY-15789758 | io.netty:netty-codec-http2 | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-03-26 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-25639 | SNYK-JS-AXIOS-15252993 | axios | 1.13.2 | Prototype Pollution | 2026-02-09 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.6 | Cross-site Scripting (XSS) | 2026-06-10 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-34477 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967727 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Validation of Certificate with Host Mismatch | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use SocketAppender, SmtpAppender, or SyslogAppender with TLS should reconfigure to avoid those appenders, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| medium | CVE-2026-2950 | SNYK-JS-LODASH-15869619 | lodash | 4.17.23 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASHES-15869621 | lodash-es | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-0540 | SNYK-JS-DOMPURIFY-15371376 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASHES-15053836 | lodash-es | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 | 9.1.6 | Upgrade to TopBraid EDG 9.1.6 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| low | CVE-2026-22735 | SNYK-JAVA-ORGSPRINGFRAMEWORK-15701755 | org.springframework:spring-web | 6.2.12 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 2026-03-19 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Incomplete List of Disallowed Inputs | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Deserialization of Untrusted Data | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.2.9.Final | Incorrect Comparison | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.12.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.13.2 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.13.2 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.13.2 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.81.1 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40983 | SNYK-JAVA-IOMICROMETER-17339194 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-09 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305998 | org.springframework.security:spring-security-web | 6.5.6 | User Impersonation | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305999 | org.springframework.security:spring-security-config | 6.5.6 | User Impersonation | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.12 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.12 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.12 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.15 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.13.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.12.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.12.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.12.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.13.2 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.13.2 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.13.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42583 | SNYK-JAVA-IONETTY-16438323 | io.netty:netty-codec-compression | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42585 | SNYK-JAVA-IONETTY-16438737 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42584 | SNYK-JAVA-IONETTY-16438923 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438929 | io.netty:netty-codec-http2 | 4.2.9.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438931 | io.netty:netty-codec-compression | 4.2.9.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42581 | SNYK-JAVA-IONETTY-16438934 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42577 | SNYK-JAVA-IONETTY-16438936 | io.netty:netty-transport-classes-epoll | 4.2.9.Final | Missing Release of Resource after Effective Lifetime | 2026-05-06 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.7 | Unsafe Reflection | 2026-05-04 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.7 | XML External Entity (XXE) Injection | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.7 | Memory Allocation with Excessive Size Value | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.13.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.13.2 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-22740 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109615 | org.springframework:spring-web | 6.2.12 | Incomplete Cleanup | 2026-04-17 | 9.1.5 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.81 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.81 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 | com.fasterxml.jackson.core:jackson-core | 2.20.0 | Allocation of Resources Without Limits or Throttling | 2026-04-04 | 9.1.3 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15365924 | com.fasterxml.jackson.core:jackson-core | 2.20.0 | Allocation of Resources Without Limits or Throttling | 2026-02-28 | 9.1.3 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Server-side Request Forgery (SSRF) | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.3.0 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.3.0 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.3.0 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.3.0 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.0 | Inefficient Algorithmic Complexity | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-06-12 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.4 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.2.9.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 9.1.7 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 6.5.6 | Open Redirect | 2026-06-10 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 6.5.6 | Information Exposure | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.2.9.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.12 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.12 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.12 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.12 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.12 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.12 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.13.2 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.13.2 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.13.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-33245 | SNYK-JS-REACTROUTER-17137545 | react-router | 7.12.0 | Cross-site Scripting (XSS) | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.13.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-42580 | SNYK-JAVA-IONETTY-16438926 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41417 | SNYK-JAVA-IONETTY-16425695 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-05 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.13.2 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.13.2 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.13.2 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.13.2 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.13.2 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.13.2 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.13.2 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-40542 | SNYK-JAVA-ORGAPACHEHTTPCOMPONENTSCLIENT5-16134546 | org.apache.httpcomponents.client5:httpclient5 | 5.6 | Missing Critical Step in Authentication | 2026-04-23 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22746 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121176 | org.springframework.security:spring-security-core | 6.5.6 | Information Exposure | 2026-04-22 | 9.1.7 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22748 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448 | org.springframework.security:spring-security-oauth2-jose | 6.5.6 | Insufficient Verification of Data Authenticity | 2026-04-22 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22751 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16120313 | org.springframework.security:spring-security-core | 6.5.6 | Time-of-check Time-of-use (TOCTOU) Race Condition | 2026-04-21 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22745 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109618 | org.springframework:spring-core | 6.2.12 | Allocation of Resources Without Limits or Throttling | 2026-04-17 | 9.1.5 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.3.0 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.81 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.13.2 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | (none) | SNYK-JS-DOMPURIFY-15874903 | dompurify | 3.3.0 | Prototype Pollution | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15874905 | dompurify | 3.3.0 | Permissive List of Allowed Inputs | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15810938 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-03-27 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.3.0 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-53663 | SNYK-JS-REACTROUTER-17342510 | react-router | 7.12.0 | Cross-site Request Forgery (CSRF) | 2026-06-15 | 9.2.2 | vulnerable_code_not_in_execute_path |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-22732 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-15701796 | org.springframework.security:spring-security-web | 6.5.6 | Use of Cache Containing Sensitive Information | 2026-03-20 | 9.1.3 | Upgrade to TopBraid EDG 8.5.3, 9.0.3, 9.1.3, or later, when available. |
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.2.9.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.6 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.9 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-34478 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967739 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Output Neutralization for Logs | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Rfc5424Layout with a stream-based syslog appender should reconfigure to avoid Rfc5424Layout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34480 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967769 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Encoding or Escaping of Output | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use XmlLayout should reconfigure to avoid XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34479 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967804 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Encoding or Escaping of Output | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Log4j1XmlLayout should reconfigure to avoid Log4j1XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.13.2 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASH-15869625 | lodash | 4.17.23 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASHES-15869627 | lodash-es | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-33870 | SNYK-JAVA-IONETTY-15789756 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-03-26 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-33871 | SNYK-JAVA-IONETTY-15789758 | io.netty:netty-codec-http2 | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-03-26 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-25639 | SNYK-JS-AXIOS-15252993 | axios | 1.13.2 | Prototype Pollution | 2026-02-09 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.6 | Cross-site Scripting (XSS) | 2026-06-10 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-34477 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967727 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Validation of Certificate with Host Mismatch | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use SocketAppender, SmtpAppender, or SyslogAppender with TLS should reconfigure to avoid those appenders, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| medium | CVE-2026-2950 | SNYK-JS-LODASH-15869619 | lodash | 4.17.23 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASHES-15869621 | lodash-es | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-0540 | SNYK-JS-DOMPURIFY-15371376 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASHES-15053836 | lodash-es | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 | 9.1.6 | Upgrade to TopBraid EDG 9.1.6 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| low | CVE-2026-22735 | SNYK-JAVA-ORGSPRINGFRAMEWORK-15701755 | org.springframework:spring-web | 6.2.12 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 2026-03-19 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Incomplete List of Disallowed Inputs | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Deserialization of Untrusted Data | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.2.9.Final | Incorrect Comparison | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.12.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.13.2 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.13.2 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.13.2 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.81.1 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40983 | SNYK-JAVA-IOMICROMETER-17339194 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-09 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305998 | org.springframework.security:spring-security-web | 6.5.6 | User Impersonation | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305999 | org.springframework.security:spring-security-config | 6.5.6 | User Impersonation | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.12 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.12 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.12 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.15 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.13.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.12.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.12.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.12.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.13.2 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.13.2 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.13.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42583 | SNYK-JAVA-IONETTY-16438323 | io.netty:netty-codec-compression | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42585 | SNYK-JAVA-IONETTY-16438737 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42584 | SNYK-JAVA-IONETTY-16438923 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438929 | io.netty:netty-codec-http2 | 4.2.9.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438931 | io.netty:netty-codec-compression | 4.2.9.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42581 | SNYK-JAVA-IONETTY-16438934 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42577 | SNYK-JAVA-IONETTY-16438936 | io.netty:netty-transport-classes-epoll | 4.2.9.Final | Missing Release of Resource after Effective Lifetime | 2026-05-06 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.7 | Unsafe Reflection | 2026-05-04 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.7 | XML External Entity (XXE) Injection | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.7 | Memory Allocation with Excessive Size Value | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.13.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.13.2 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-22740 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109615 | org.springframework:spring-web | 6.2.12 | Incomplete Cleanup | 2026-04-17 | 9.1.5 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.81 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.81 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 | com.fasterxml.jackson.core:jackson-core | 2.20.0 | Allocation of Resources Without Limits or Throttling | 2026-04-04 | 9.1.3 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15365924 | com.fasterxml.jackson.core:jackson-core | 2.20.0 | Allocation of Resources Without Limits or Throttling | 2026-02-28 | 9.1.3 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Server-side Request Forgery (SSRF) | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.3.0 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.3.0 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.3.0 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.3.0 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.0 | Inefficient Algorithmic Complexity | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-06-12 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.4 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.2.9.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 9.1.7 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 6.5.6 | Open Redirect | 2026-06-10 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 6.5.6 | Information Exposure | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.2.9.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.12 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.12 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.12 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.12 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.12 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.12 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.13.2 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.13.2 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.13.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-33245 | SNYK-JS-REACTROUTER-17137545 | react-router | 7.12.0 | Cross-site Scripting (XSS) | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.13.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-42580 | SNYK-JAVA-IONETTY-16438926 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41417 | SNYK-JAVA-IONETTY-16425695 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-05 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.13.2 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.13.2 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.13.2 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.13.2 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.13.2 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.13.2 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.13.2 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-40542 | SNYK-JAVA-ORGAPACHEHTTPCOMPONENTSCLIENT5-16134546 | org.apache.httpcomponents.client5:httpclient5 | 5.6 | Missing Critical Step in Authentication | 2026-04-23 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22746 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121176 | org.springframework.security:spring-security-core | 6.5.6 | Information Exposure | 2026-04-22 | 9.1.7 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22748 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448 | org.springframework.security:spring-security-oauth2-jose | 6.5.6 | Insufficient Verification of Data Authenticity | 2026-04-22 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22751 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16120313 | org.springframework.security:spring-security-core | 6.5.6 | Time-of-check Time-of-use (TOCTOU) Race Condition | 2026-04-21 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22745 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109618 | org.springframework:spring-core | 6.2.12 | Allocation of Resources Without Limits or Throttling | 2026-04-17 | 9.1.5 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.3.0 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.81 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.13.2 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | (none) | SNYK-JS-DOMPURIFY-15874903 | dompurify | 3.3.0 | Prototype Pollution | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15874905 | dompurify | 3.3.0 | Permissive List of Allowed Inputs | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15810938 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-03-27 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.3.0 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-53663 | SNYK-JS-REACTROUTER-17342510 | react-router | 7.12.0 | Cross-site Request Forgery (CSRF) | 2026-06-15 | 9.2.2 | vulnerable_code_not_in_execute_path |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-22732 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-15701796 | org.springframework.security:spring-security-web | 6.5.6 | Use of Cache Containing Sensitive Information | 2026-03-20 | 9.1.3 | Upgrade to TopBraid EDG 8.5.3, 9.0.3, 9.1.3, or later, when available. |
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.2.9.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.6 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.9 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-34478 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967739 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Output Neutralization for Logs | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Rfc5424Layout with a stream-based syslog appender should reconfigure to avoid Rfc5424Layout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34480 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967769 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Encoding or Escaping of Output | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use XmlLayout should reconfigure to avoid XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34479 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967804 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Encoding or Escaping of Output | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Log4j1XmlLayout should reconfigure to avoid Log4j1XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.13.2 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASH-15869625 | lodash | 4.17.23 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASHES-15869627 | lodash-es | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-33870 | SNYK-JAVA-IONETTY-15789756 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-03-26 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-33871 | SNYK-JAVA-IONETTY-15789758 | io.netty:netty-codec-http2 | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-03-26 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-25639 | SNYK-JS-AXIOS-15252993 | axios | 1.13.2 | Prototype Pollution | 2026-02-09 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.6 | Cross-site Scripting (XSS) | 2026-06-10 | 9.1.7 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-34477 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967727 | org.apache.logging.log4j:log4j-core | 2.25.3 | Improper Validation of Certificate with Host Mismatch | 2026-04-10 | 9.1.5 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use SocketAppender, SmtpAppender, or SyslogAppender with TLS should reconfigure to avoid those appenders, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| medium | CVE-2026-2950 | SNYK-JS-LODASH-15869619 | lodash | 4.17.23 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASHES-15869621 | lodash-es | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-0540 | SNYK-JS-DOMPURIFY-15371376 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASHES-15053836 | lodash-es | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 | 9.1.6 | Upgrade to TopBraid EDG 9.1.6 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| low | CVE-2026-22735 | SNYK-JAVA-ORGSPRINGFRAMEWORK-15701755 | org.springframework:spring-web | 6.2.12 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 2026-03-19 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Incomplete List of Disallowed Inputs | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Deserialization of Untrusted Data | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.2.9.Final | Incorrect Comparison | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.12.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.13.2 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.13.2 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.13.2 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.81.1 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40983 | SNYK-JAVA-IOMICROMETER-17339194 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-09 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305998 | org.springframework.security:spring-security-web | 6.5.6 | User Impersonation | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305999 | org.springframework.security:spring-security-config | 6.5.6 | User Impersonation | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.15.4 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.12 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.12 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.12 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.15 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.13.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.12.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.12.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.12.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.13.2 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.13.2 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.13.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42583 | SNYK-JAVA-IONETTY-16438323 | io.netty:netty-codec-compression | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42585 | SNYK-JAVA-IONETTY-16438737 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42584 | SNYK-JAVA-IONETTY-16438923 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438929 | io.netty:netty-codec-http2 | 4.2.9.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438931 | io.netty:netty-codec-compression | 4.2.9.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42581 | SNYK-JAVA-IONETTY-16438934 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42577 | SNYK-JAVA-IONETTY-16438936 | io.netty:netty-transport-classes-epoll | 4.2.9.Final | Missing Release of Resource after Effective Lifetime | 2026-05-06 | 9.1.7 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.7 | Unsafe Reflection | 2026-05-04 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.7 | XML External Entity (XXE) Injection | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.7 | Memory Allocation with Excessive Size Value | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.13.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.13.2 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-22740 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109615 | org.springframework:spring-web | 6.2.12 | Incomplete Cleanup | 2026-04-17 | 9.1.5 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.81 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.81 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 | com.fasterxml.jackson.core:jackson-core | 2.20.0 | Allocation of Resources Without Limits or Throttling | 2026-04-04 | 9.1.3 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15365924 | com.fasterxml.jackson.core:jackson-core | 2.20.0 | Allocation of Resources Without Limits or Throttling | 2026-02-28 | 9.1.3 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Server-side Request Forgery (SSRF) | 2026-06-23 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.3.0 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.3.0 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.3.0 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.3.0 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.0 | Inefficient Algorithmic Complexity | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-06-12 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.4 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.2.9.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 9.1.7 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 6.5.6 | Open Redirect | 2026-06-10 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 6.5.6 | Information Exposure | 2026-06-09 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.2.9.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.2.9.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.12 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.12 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.12 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.12 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.12 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.12 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.13.2 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.13.2 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.13.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-33245 | SNYK-JS-REACTROUTER-17137545 | react-router | 7.12.0 | Cross-site Scripting (XSS) | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.13.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-42580 | SNYK-JAVA-IONETTY-16438926 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-07 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41417 | SNYK-JAVA-IONETTY-16425695 | io.netty:netty-codec-http | 4.2.9.Final | HTTP Request Smuggling | 2026-05-05 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.13.2 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.13.2 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.13.2 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.13.2 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.13.2 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.13.2 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.13.2 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-40542 | SNYK-JAVA-ORGAPACHEHTTPCOMPONENTSCLIENT5-16134546 | org.apache.httpcomponents.client5:httpclient5 | 5.6 | Missing Critical Step in Authentication | 2026-04-23 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22746 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121176 | org.springframework.security:spring-security-core | 6.5.6 | Information Exposure | 2026-04-22 | 9.1.7 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22748 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448 | org.springframework.security:spring-security-oauth2-jose | 6.5.6 | Insufficient Verification of Data Authenticity | 2026-04-22 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22751 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16120313 | org.springframework.security:spring-security-core | 6.5.6 | Time-of-check Time-of-use (TOCTOU) Race Condition | 2026-04-21 | 9.1.7 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22745 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109618 | org.springframework:spring-core | 6.2.12 | Allocation of Resources Without Limits or Throttling | 2026-04-17 | 9.1.5 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.3.0 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.81 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.13.2 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | (none) | SNYK-JS-DOMPURIFY-15874903 | dompurify | 3.3.0 | Prototype Pollution | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15874905 | dompurify | 3.3.0 | Permissive List of Allowed Inputs | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15810938 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-03-27 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.3.0 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-53663 | SNYK-JS-REACTROUTER-17342510 | react-router | 7.12.0 | Cross-site Request Forgery (CSRF) | 2026-06-15 | 9.2.2 | vulnerable_code_not_in_execute_path |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.3.0 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
Previous release was affected, but this one is not.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed |
|---|---|---|---|---|---|---|
| high | CVE-2025-68470 | SNYK-JS-REACTROUTER-14908286 | react-router | 7.6.0 | Open Redirect | 2026-01-08 |
| high | CVE-2026-22029 | SNYK-JS-REACTROUTER-14908531 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 |
| high | CVE-2025-55163 | SNYK-JAVA-IOGRPC-13786834 | io.grpc:grpc-netty-shaded | 1.68.0 | Allocation of Resources Without Limits or Throttling | 2025-08-13 |
| medium | CVE-2025-13465 | SNYK-JS-LODASH-15053838 | lodash | 4.17.21 | Prototype Pollution | 2026-01-21 |
| medium | CVE-2025-59057 | SNYK-JS-REACTROUTER-14908289 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 |
| medium | CVE-2026-21884 | SNYK-JS-REACTROUTER-14908293 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 |
| medium | CVE-2026-22030 | SNYK-JS-REACTROUTER-14908429 | react-router | 7.6.0 | Cross-site Request Forgery (CSRF) | 2026-01-08 |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.9 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.12.2 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASH-15869625 | lodash | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASHES-15869627 | lodash-es | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-25639 | SNYK-JS-AXIOS-15252993 | axios | 1.12.2 | Prototype Pollution | 2026-02-09 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| high | CVE-2025-68470 | SNYK-JS-REACTROUTER-14908286 | react-router | 7.6.0 | Open Redirect | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2026-22029 | SNYK-JS-REACTROUTER-14908531 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2025-55163 | SNYK-JAVA-IOGRPC-13786834 | io.grpc:grpc-netty-shaded | 1.68.0 | Allocation of Resources Without Limits or Throttling | 2025-08-13 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASH-15869619 | lodash | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASHES-15869621 | lodash-es | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-0540 | SNYK-JS-DOMPURIFY-15371376 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASH-15053838 | lodash | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASHES-15053836 | lodash-es | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2025-59057 | SNYK-JS-REACTROUTER-14908289 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-21884 | SNYK-JS-REACTROUTER-14908293 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-22030 | SNYK-JS-REACTROUTER-14908429 | react-router | 7.6.0 | Cross-site Request Forgery (CSRF) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 | 9.1.6 | Upgrade to TopBraid EDG 9.1.6 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.6.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.12.2 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.12.2 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.12.2 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.81.1 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40983 | SNYK-JAVA-IOMICROMETER-17339194 | io.micrometer:micrometer-core | 1.15.1 | Allocation of Resources Without Limits or Throttling | 2026-06-09 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.15.1 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.18 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.18 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.18 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.16 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.12.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.6.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.12.2 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.12.2 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.12.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.5 | Unsafe Reflection | 2026-05-04 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.5 | XML External Entity (XXE) Injection | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.5 | Memory Allocation with Excessive Size Value | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.12.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.12.2 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.81 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.81 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.22.0 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.2.6 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.2.6 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.2.6 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.2.6 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.0 | Inefficient Algorithmic Complexity | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.4 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.18 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.18 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.18 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.18 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.18 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.18 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.12.2 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.12.2 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.12.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.12.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.12.2 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.12.2 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.12.2 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.12.2 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.12.2 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.12.2 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.12.2 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.2.6 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.81 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.12.2 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | (none) | SNYK-JS-DOMPURIFY-15874903 | dompurify | 3.2.6 | Prototype Pollution | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15874905 | dompurify | 3.2.6 | Permissive List of Allowed Inputs | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15810938 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-03-27 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-15599 | SNYK-JS-DOMPURIFY-15371386 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.0 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.2.6 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
Previous release was affected, but this one is not.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed |
|---|---|---|---|---|---|---|
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.2.6.Final | Improper Verification of Cryptographic Signature | 2026-06-12 |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 |
| high | CVE-2026-33870 | SNYK-JAVA-IONETTY-15789756 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-03-26 |
| high | CVE-2026-33871 | SNYK-JAVA-IONETTY-15789758 | io.netty:netty-codec-http2 | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-03-26 |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Cross-site Scripting (XSS) | 2026-06-10 |
| medium | CVE-2025-67735 | SNYK-JAVA-IONETTY-14423947 | io.netty:netty-codec-http | 4.2.6.Final | CRLF Injection | 2025-12-15 |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.2.6.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 9.0.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 9.0.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.9 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.12.2 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASH-15869625 | lodash | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASHES-15869627 | lodash-es | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-33870 | SNYK-JAVA-IONETTY-15789756 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-03-26 | 9.0.4 | Upgrade to TopBraid EDG 9.0.4 or later. |
| high | CVE-2026-33871 | SNYK-JAVA-IONETTY-15789758 | io.netty:netty-codec-http2 | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-03-26 | 9.0.4 | Upgrade to TopBraid EDG 9.0.4 or later. |
| high | CVE-2026-25639 | SNYK-JS-AXIOS-15252993 | axios | 1.12.2 | Prototype Pollution | 2026-02-09 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| high | CVE-2025-68470 | SNYK-JS-REACTROUTER-14908286 | react-router | 7.6.0 | Open Redirect | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2026-22029 | SNYK-JS-REACTROUTER-14908531 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2025-55163 | SNYK-JAVA-IOGRPC-13786834 | io.grpc:grpc-netty-shaded | 1.68.0 | Allocation of Resources Without Limits or Throttling | 2025-08-13 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Cross-site Scripting (XSS) | 2026-06-10 | 9.0.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASH-15869619 | lodash | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASHES-15869621 | lodash-es | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-0540 | SNYK-JS-DOMPURIFY-15371376 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASH-15053838 | lodash | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASHES-15053836 | lodash-es | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2025-59057 | SNYK-JS-REACTROUTER-14908289 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-21884 | SNYK-JS-REACTROUTER-14908293 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-22030 | SNYK-JS-REACTROUTER-14908429 | react-router | 7.6.0 | Cross-site Request Forgery (CSRF) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-67735 | SNYK-JAVA-IONETTY-14423947 | io.netty:netty-codec-http | 4.2.6.Final | CRLF Injection | 2025-12-15 | 9.0.4 | Upgrade to TopBraid EDG 9.0.4 or later. |
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 | 9.1.6 | Upgrade to TopBraid EDG 9.1.6 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Incomplete List of Disallowed Inputs | 2026-06-23 | 9.0.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Deserialization of Untrusted Data | 2026-06-23 | 9.0.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.2.6.Final | Incorrect Comparison | 2026-06-08 | 9.0.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.6.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.12.2 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.12.2 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.12.2 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.81.1 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40983 | SNYK-JAVA-IOMICROMETER-17339194 | io.micrometer:micrometer-core | 1.15.1 | Allocation of Resources Without Limits or Throttling | 2026-06-09 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305998 | org.springframework.security:spring-security-web | 6.5.9 | User Impersonation | 2026-06-09 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305999 | org.springframework.security:spring-security-config | 6.5.9 | User Impersonation | 2026-06-09 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.15.1 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.18 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.18 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.18 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.16 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.12.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.6.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.12.2 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.12.2 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.12.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42583 | SNYK-JAVA-IONETTY-16438323 | io.netty:netty-codec-compression | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42585 | SNYK-JAVA-IONETTY-16438737 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42584 | SNYK-JAVA-IONETTY-16438923 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438929 | io.netty:netty-codec-http2 | 4.2.6.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438931 | io.netty:netty-codec-compression | 4.2.6.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42581 | SNYK-JAVA-IONETTY-16438934 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42577 | SNYK-JAVA-IONETTY-16438936 | io.netty:netty-transport-classes-epoll | 4.2.6.Final | Missing Release of Resource after Effective Lifetime | 2026-05-06 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.5 | Unsafe Reflection | 2026-05-04 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.5 | XML External Entity (XXE) Injection | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.5 | Memory Allocation with Excessive Size Value | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.12.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.12.2 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.81 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.81 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 | com.fasterxml.jackson.core:jackson-core | 2.20.0 | Allocation of Resources Without Limits or Throttling | 2026-04-04 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15365924 | com.fasterxml.jackson.core:jackson-core | 2.20.0 | Allocation of Resources Without Limits or Throttling | 2026-02-28 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Server-side Request Forgery (SSRF) | 2026-06-23 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.2.6 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.2.6 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.2.6 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.2.6 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.0 | Inefficient Algorithmic Complexity | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-06-12 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.4 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.2.6.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 9.0.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 6.5.9 | Open Redirect | 2026-06-10 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Information Exposure | 2026-06-09 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.2.6.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.18 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.18 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.18 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.18 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.18 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.18 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.12.2 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.12.2 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.12.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.12.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-42580 | SNYK-JAVA-IONETTY-16438926 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41417 | SNYK-JAVA-IONETTY-16425695 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-05 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.12.2 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.12.2 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.12.2 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.12.2 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.12.2 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.12.2 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.12.2 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22746 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121176 | org.springframework.security:spring-security-core | 6.5.9 | Information Exposure | 2026-04-22 | 9.0.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22748 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448 | org.springframework.security:spring-security-oauth2-jose | 6.5.9 | Insufficient Verification of Data Authenticity | 2026-04-22 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22751 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16120313 | org.springframework.security:spring-security-core | 6.5.9 | Time-of-check Time-of-use (TOCTOU) Race Condition | 2026-04-21 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.2.6 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.81 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.12.2 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | (none) | SNYK-JS-DOMPURIFY-15874903 | dompurify | 3.2.6 | Prototype Pollution | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15874905 | dompurify | 3.2.6 | Permissive List of Allowed Inputs | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15810938 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-03-27 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-15599 | SNYK-JS-DOMPURIFY-15371386 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.0 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.2.6 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
Previous release was affected, but this one is not.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed |
|---|---|---|---|---|---|---|
| critical | CVE-2026-22732 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-15701796 | org.springframework.security:spring-security-web | 6.5.5 | Use of Cache Containing Sensitive Information | 2026-03-20 |
| high | CVE-2026-34478 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967739 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Output Neutralization for Logs | 2026-04-10 |
| high | CVE-2026-34480 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967769 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Encoding or Escaping of Output | 2026-04-10 |
| high | CVE-2026-34479 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967804 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Encoding or Escaping of Output | 2026-04-10 |
| medium | CVE-2026-34477 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967727 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Validation of Certificate with Host Mismatch | 2026-04-10 |
| medium | CVE-2025-68161 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-14532782 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Validation of Certificate with Host Mismatch | 2025-12-18 |
| low | CVE-2026-22735 | SNYK-JAVA-ORGSPRINGFRAMEWORK-15701755 | org.springframework:spring-web | 6.2.11 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 2026-03-19 |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-22732 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-15701796 | org.springframework.security:spring-security-web | 6.5.5 | Use of Cache Containing Sensitive Information | 2026-03-20 | 9.0.3 | Upgrade to TopBraid EDG 8.5.3, 9.0.3, 9.1.3, or later, when available. |
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.2.6.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 9.0.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.5 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 9.0.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.9 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-34478 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967739 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Output Neutralization for Logs | 2026-04-10 | 9.0.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Rfc5424Layout with a stream-based syslog appender should reconfigure to avoid Rfc5424Layout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34480 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967769 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Encoding or Escaping of Output | 2026-04-10 | 9.0.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use XmlLayout should reconfigure to avoid XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34479 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967804 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Encoding or Escaping of Output | 2026-04-10 | 9.0.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Log4j1XmlLayout should reconfigure to avoid Log4j1XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.12.2 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASH-15869625 | lodash | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASHES-15869627 | lodash-es | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-33870 | SNYK-JAVA-IONETTY-15789756 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-03-26 | 9.0.4 | Upgrade to TopBraid EDG 9.0.4 or later. |
| high | CVE-2026-33871 | SNYK-JAVA-IONETTY-15789758 | io.netty:netty-codec-http2 | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-03-26 | 9.0.4 | Upgrade to TopBraid EDG 9.0.4 or later. |
| high | CVE-2026-25639 | SNYK-JS-AXIOS-15252993 | axios | 1.12.2 | Prototype Pollution | 2026-02-09 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| high | CVE-2025-68470 | SNYK-JS-REACTROUTER-14908286 | react-router | 7.6.0 | Open Redirect | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2026-22029 | SNYK-JS-REACTROUTER-14908531 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2025-55163 | SNYK-JAVA-IOGRPC-13786834 | io.grpc:grpc-netty-shaded | 1.68.0 | Allocation of Resources Without Limits or Throttling | 2025-08-13 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.5 | Cross-site Scripting (XSS) | 2026-06-10 | 9.0.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-34477 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967727 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Validation of Certificate with Host Mismatch | 2026-04-10 | 9.0.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use SocketAppender, SmtpAppender, or SyslogAppender with TLS should reconfigure to avoid those appenders, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| medium | CVE-2026-2950 | SNYK-JS-LODASH-15869619 | lodash | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASHES-15869621 | lodash-es | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-0540 | SNYK-JS-DOMPURIFY-15371376 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASH-15053838 | lodash | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASHES-15053836 | lodash-es | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2025-59057 | SNYK-JS-REACTROUTER-14908289 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-21884 | SNYK-JS-REACTROUTER-14908293 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-22030 | SNYK-JS-REACTROUTER-14908429 | react-router | 7.6.0 | Cross-site Request Forgery (CSRF) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-68161 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-14532782 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Validation of Certificate with Host Mismatch | 2025-12-18 | 9.0.3 | Upgrade to TopBraid EDG 9.0.3 or later. |
| medium | CVE-2025-67735 | SNYK-JAVA-IONETTY-14423947 | io.netty:netty-codec-http | 4.2.6.Final | CRLF Injection | 2025-12-15 | 9.0.4 | Upgrade to TopBraid EDG 9.0.4 or later. |
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 | 9.1.6 | Upgrade to TopBraid EDG 9.1.6 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| low | CVE-2026-22735 | SNYK-JAVA-ORGSPRINGFRAMEWORK-15701755 | org.springframework:spring-web | 6.2.11 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 2026-03-19 | 9.0.3 | Upgrade to TopBraid EDG 9.0.3 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Incomplete List of Disallowed Inputs | 2026-06-23 | 9.0.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Deserialization of Untrusted Data | 2026-06-23 | 9.0.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.2.6.Final | Incorrect Comparison | 2026-06-08 | 9.0.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.6.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.12.2 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.12.2 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.12.2 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.81.1 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40983 | SNYK-JAVA-IOMICROMETER-17339194 | io.micrometer:micrometer-core | 1.15.1 | Allocation of Resources Without Limits or Throttling | 2026-06-09 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305998 | org.springframework.security:spring-security-web | 6.5.5 | User Impersonation | 2026-06-09 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305999 | org.springframework.security:spring-security-config | 6.5.5 | User Impersonation | 2026-06-09 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.15.1 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.11 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.11 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.11 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.14 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.12.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.6.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.12.2 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.12.2 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.12.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42583 | SNYK-JAVA-IONETTY-16438323 | io.netty:netty-codec-compression | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42585 | SNYK-JAVA-IONETTY-16438737 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42584 | SNYK-JAVA-IONETTY-16438923 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438929 | io.netty:netty-codec-http2 | 4.2.6.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438931 | io.netty:netty-codec-compression | 4.2.6.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42581 | SNYK-JAVA-IONETTY-16438934 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42577 | SNYK-JAVA-IONETTY-16438936 | io.netty:netty-transport-classes-epoll | 4.2.6.Final | Missing Release of Resource after Effective Lifetime | 2026-05-06 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.5 | Unsafe Reflection | 2026-05-04 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.5 | XML External Entity (XXE) Injection | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.5 | Memory Allocation with Excessive Size Value | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.12.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.12.2 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-22740 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109615 | org.springframework:spring-web | 6.2.11 | Incomplete Cleanup | 2026-04-17 | 9.0.3 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.81 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.81 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 | com.fasterxml.jackson.core:jackson-core | 2.20.0 | Allocation of Resources Without Limits or Throttling | 2026-04-04 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15365924 | com.fasterxml.jackson.core:jackson-core | 2.20.0 | Allocation of Resources Without Limits or Throttling | 2026-02-28 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Server-side Request Forgery (SSRF) | 2026-06-23 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.2.6 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.2.6 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.2.6 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.2.6 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.0 | Inefficient Algorithmic Complexity | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-06-12 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.4 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.2.6.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 9.0.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 6.5.5 | Open Redirect | 2026-06-10 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 6.5.5 | Information Exposure | 2026-06-09 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.2.6.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.11 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.11 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.11 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.11 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.11 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.11 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.12.2 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.12.2 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.12.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.12.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-42580 | SNYK-JAVA-IONETTY-16438926 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41417 | SNYK-JAVA-IONETTY-16425695 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-05 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.12.2 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.12.2 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.12.2 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.12.2 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.12.2 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.12.2 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.12.2 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22746 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121176 | org.springframework.security:spring-security-core | 6.5.5 | Information Exposure | 2026-04-22 | 9.0.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22748 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448 | org.springframework.security:spring-security-oauth2-jose | 6.5.5 | Insufficient Verification of Data Authenticity | 2026-04-22 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22751 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16120313 | org.springframework.security:spring-security-core | 6.5.5 | Time-of-check Time-of-use (TOCTOU) Race Condition | 2026-04-21 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22745 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109618 | org.springframework:spring-core | 6.2.11 | Allocation of Resources Without Limits or Throttling | 2026-04-17 | 9.0.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.2.6 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.81 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.12.2 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | (none) | SNYK-JS-DOMPURIFY-15874903 | dompurify | 3.2.6 | Prototype Pollution | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15874905 | dompurify | 3.2.6 | Permissive List of Allowed Inputs | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15810938 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-03-27 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-15599 | SNYK-JS-DOMPURIFY-15371386 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.0 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.2.6 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
Previous release was affected, but this one is not.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed |
|---|---|---|---|---|---|---|
| high | CVE-2026-47691 | SNYK-JAVA-IONETTY-17261020 | io.netty:netty-resolver-dns | 4.2.6.Final | Insufficient Verification of Data Authenticity | 2026-06-08 |
| high | CVE-2026-45674 | SNYK-JAVA-IONETTY-17262734 | io.netty:netty-resolver-dns | 4.2.6.Final | Insufficient Verification of Data Authenticity | 2026-06-08 |
| high | CVE-2026-42579 | SNYK-JAVA-IONETTY-16438938 | io.netty:netty-codec-dns | 4.2.6.Final | Null Byte Interaction Error (Poison Null Byte) | 2026-05-07 |
| medium | CVE-2026-45673 | SNYK-JAVA-IONETTY-17261131 | io.netty:netty-resolver-dns | 4.2.6.Final | Generation of Predictable Numbers or Identifiers | 2026-06-08 |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-22732 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-15701796 | org.springframework.security:spring-security-web | 6.5.5 | Use of Cache Containing Sensitive Information | 2026-03-20 | 9.0.3 | Upgrade to TopBraid EDG 8.5.3, 9.0.3, 9.1.3, or later, when available. |
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.2.6.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 9.0.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.5 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 9.0.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-47691 | SNYK-JAVA-IONETTY-17261020 | io.netty:netty-resolver-dns | 4.2.6.Final | Insufficient Verification of Data Authenticity | 2026-06-08 | 9.0.2 | Upgrade to TopBraid EDG 9.0.2 or later. |
| high | CVE-2026-45674 | SNYK-JAVA-IONETTY-17262734 | io.netty:netty-resolver-dns | 4.2.6.Final | Insufficient Verification of Data Authenticity | 2026-06-08 | 9.0.2 | Upgrade to TopBraid EDG 9.0.2 or later. |
| high | CVE-2026-42579 | SNYK-JAVA-IONETTY-16438938 | io.netty:netty-codec-dns | 4.2.6.Final | Null Byte Interaction Error (Poison Null Byte) | 2026-05-07 | 9.0.2 | Upgrade to TopBraid EDG 9.0.2 or later. |
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.9 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-34478 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967739 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Output Neutralization for Logs | 2026-04-10 | 9.0.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Rfc5424Layout with a stream-based syslog appender should reconfigure to avoid Rfc5424Layout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34480 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967769 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Encoding or Escaping of Output | 2026-04-10 | 9.0.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use XmlLayout should reconfigure to avoid XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34479 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967804 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Encoding or Escaping of Output | 2026-04-10 | 9.0.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Log4j1XmlLayout should reconfigure to avoid Log4j1XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.12.2 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASH-15869625 | lodash | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASHES-15869627 | lodash-es | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-33870 | SNYK-JAVA-IONETTY-15789756 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-03-26 | 9.0.4 | Upgrade to TopBraid EDG 9.0.4 or later. |
| high | CVE-2026-33871 | SNYK-JAVA-IONETTY-15789758 | io.netty:netty-codec-http2 | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-03-26 | 9.0.4 | Upgrade to TopBraid EDG 9.0.4 or later. |
| high | CVE-2026-25639 | SNYK-JS-AXIOS-15252993 | axios | 1.12.2 | Prototype Pollution | 2026-02-09 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| high | CVE-2025-68470 | SNYK-JS-REACTROUTER-14908286 | react-router | 7.6.0 | Open Redirect | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2026-22029 | SNYK-JS-REACTROUTER-14908531 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2025-55163 | SNYK-JAVA-IOGRPC-13786834 | io.grpc:grpc-netty-shaded | 1.68.0 | Allocation of Resources Without Limits or Throttling | 2025-08-13 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.5 | Cross-site Scripting (XSS) | 2026-06-10 | 9.0.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-45673 | SNYK-JAVA-IONETTY-17261131 | io.netty:netty-resolver-dns | 4.2.6.Final | Generation of Predictable Numbers or Identifiers | 2026-06-08 | 9.0.2 | Upgrade to TopBraid EDG 9.0.2 or later. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-34477 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967727 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Validation of Certificate with Host Mismatch | 2026-04-10 | 9.0.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use SocketAppender, SmtpAppender, or SyslogAppender with TLS should reconfigure to avoid those appenders, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| medium | CVE-2026-2950 | SNYK-JS-LODASH-15869619 | lodash | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASHES-15869621 | lodash-es | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-0540 | SNYK-JS-DOMPURIFY-15371376 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASH-15053838 | lodash | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASHES-15053836 | lodash-es | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2025-59057 | SNYK-JS-REACTROUTER-14908289 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-21884 | SNYK-JS-REACTROUTER-14908293 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-22030 | SNYK-JS-REACTROUTER-14908429 | react-router | 7.6.0 | Cross-site Request Forgery (CSRF) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-68161 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-14532782 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Validation of Certificate with Host Mismatch | 2025-12-18 | 9.0.3 | Upgrade to TopBraid EDG 9.0.3 or later. |
| medium | CVE-2025-67735 | SNYK-JAVA-IONETTY-14423947 | io.netty:netty-codec-http | 4.2.6.Final | CRLF Injection | 2025-12-15 | 9.0.4 | Upgrade to TopBraid EDG 9.0.4 or later. |
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 | 9.1.6 | Upgrade to TopBraid EDG 9.1.6 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| low | CVE-2026-22735 | SNYK-JAVA-ORGSPRINGFRAMEWORK-15701755 | org.springframework:spring-web | 6.2.11 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 2026-03-19 | 9.0.3 | Upgrade to TopBraid EDG 9.0.3 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Incomplete List of Disallowed Inputs | 2026-06-23 | 9.0.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Deserialization of Untrusted Data | 2026-06-23 | 9.0.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.2.6.Final | Incorrect Comparison | 2026-06-08 | 9.0.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.6.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.12.2 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.12.2 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.12.2 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.81.1 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40983 | SNYK-JAVA-IOMICROMETER-17339194 | io.micrometer:micrometer-core | 1.15.1 | Allocation of Resources Without Limits or Throttling | 2026-06-09 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305998 | org.springframework.security:spring-security-web | 6.5.5 | User Impersonation | 2026-06-09 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305999 | org.springframework.security:spring-security-config | 6.5.5 | User Impersonation | 2026-06-09 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.15.1 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.11 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.11 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.11 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.14 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.12.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.6.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.12.2 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.12.2 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.12.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42583 | SNYK-JAVA-IONETTY-16438323 | io.netty:netty-codec-compression | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42585 | SNYK-JAVA-IONETTY-16438737 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42584 | SNYK-JAVA-IONETTY-16438923 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438929 | io.netty:netty-codec-http2 | 4.2.6.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438931 | io.netty:netty-codec-compression | 4.2.6.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42581 | SNYK-JAVA-IONETTY-16438934 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42577 | SNYK-JAVA-IONETTY-16438936 | io.netty:netty-transport-classes-epoll | 4.2.6.Final | Missing Release of Resource after Effective Lifetime | 2026-05-06 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.5 | Unsafe Reflection | 2026-05-04 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.5 | XML External Entity (XXE) Injection | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.5 | Memory Allocation with Excessive Size Value | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.12.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.12.2 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-22740 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109615 | org.springframework:spring-web | 6.2.11 | Incomplete Cleanup | 2026-04-17 | 9.0.3 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.81 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.81 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 | com.fasterxml.jackson.core:jackson-core | 2.20.0 | Allocation of Resources Without Limits or Throttling | 2026-04-04 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15365924 | com.fasterxml.jackson.core:jackson-core | 2.20.0 | Allocation of Resources Without Limits or Throttling | 2026-02-28 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Server-side Request Forgery (SSRF) | 2026-06-23 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.2.6 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.2.6 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.2.6 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.2.6 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.0 | Inefficient Algorithmic Complexity | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-06-12 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.4 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.2.6.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 9.0.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 6.5.5 | Open Redirect | 2026-06-10 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 6.5.5 | Information Exposure | 2026-06-09 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.2.6.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41715 | SNYK-JAVA-IOPROJECTREACTORNETTY-17260961 | io.projectreactor.netty:reactor-netty-http | 1.2.9 | Cleartext Transmission of Sensitive Information | 2026-06-08 | 9.0.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.11 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.11 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.11 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.11 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.11 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.11 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.12.2 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.12.2 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.12.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.12.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-42580 | SNYK-JAVA-IONETTY-16438926 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42578 | SNYK-JAVA-IONETTY-16438935 | io.netty:netty-handler-proxy | 4.2.6.Final | CRLF Injection | 2026-05-07 | 9.0.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41417 | SNYK-JAVA-IONETTY-16425695 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-05 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.12.2 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.12.2 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.12.2 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.12.2 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.12.2 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.12.2 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.12.2 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22746 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121176 | org.springframework.security:spring-security-core | 6.5.5 | Information Exposure | 2026-04-22 | 9.0.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22748 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448 | org.springframework.security:spring-security-oauth2-jose | 6.5.5 | Insufficient Verification of Data Authenticity | 2026-04-22 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22751 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16120313 | org.springframework.security:spring-security-core | 6.5.5 | Time-of-check Time-of-use (TOCTOU) Race Condition | 2026-04-21 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22745 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109618 | org.springframework:spring-core | 6.2.11 | Allocation of Resources Without Limits or Throttling | 2026-04-17 | 9.0.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.2.6 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.81 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.12.2 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | (none) | SNYK-JS-DOMPURIFY-15874903 | dompurify | 3.2.6 | Prototype Pollution | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15874905 | dompurify | 3.2.6 | Permissive List of Allowed Inputs | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15810938 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-03-27 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-15599 | SNYK-JS-DOMPURIFY-15371386 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.0 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.2.6 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-22732 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-15701796 | org.springframework.security:spring-security-web | 6.5.5 | Use of Cache Containing Sensitive Information | 2026-03-20 | 9.0.3 | Upgrade to TopBraid EDG 8.5.3, 9.0.3, 9.1.3, or later, when available. |
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.2.6.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 9.0.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.5 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 9.0.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-47691 | SNYK-JAVA-IONETTY-17261020 | io.netty:netty-resolver-dns | 4.2.6.Final | Insufficient Verification of Data Authenticity | 2026-06-08 | 9.0.2 | Upgrade to TopBraid EDG 9.0.2 or later. |
| high | CVE-2026-45674 | SNYK-JAVA-IONETTY-17262734 | io.netty:netty-resolver-dns | 4.2.6.Final | Insufficient Verification of Data Authenticity | 2026-06-08 | 9.0.2 | Upgrade to TopBraid EDG 9.0.2 or later. |
| high | CVE-2026-42579 | SNYK-JAVA-IONETTY-16438938 | io.netty:netty-codec-dns | 4.2.6.Final | Null Byte Interaction Error (Poison Null Byte) | 2026-05-07 | 9.0.2 | Upgrade to TopBraid EDG 9.0.2 or later. |
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.9 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-34478 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967739 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Output Neutralization for Logs | 2026-04-10 | 9.0.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Rfc5424Layout with a stream-based syslog appender should reconfigure to avoid Rfc5424Layout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34480 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967769 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Encoding or Escaping of Output | 2026-04-10 | 9.0.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use XmlLayout should reconfigure to avoid XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34479 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967804 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Encoding or Escaping of Output | 2026-04-10 | 9.0.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Log4j1XmlLayout should reconfigure to avoid Log4j1XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.12.2 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASH-15869625 | lodash | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASHES-15869627 | lodash-es | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-33870 | SNYK-JAVA-IONETTY-15789756 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-03-26 | 9.0.4 | Upgrade to TopBraid EDG 9.0.4 or later. |
| high | CVE-2026-33871 | SNYK-JAVA-IONETTY-15789758 | io.netty:netty-codec-http2 | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-03-26 | 9.0.4 | Upgrade to TopBraid EDG 9.0.4 or later. |
| high | CVE-2026-25639 | SNYK-JS-AXIOS-15252993 | axios | 1.12.2 | Prototype Pollution | 2026-02-09 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| high | CVE-2025-68470 | SNYK-JS-REACTROUTER-14908286 | react-router | 7.6.0 | Open Redirect | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2026-22029 | SNYK-JS-REACTROUTER-14908531 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2025-55163 | SNYK-JAVA-IOGRPC-13786834 | io.grpc:grpc-netty-shaded | 1.68.0 | Allocation of Resources Without Limits or Throttling | 2025-08-13 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.5 | Cross-site Scripting (XSS) | 2026-06-10 | 9.0.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-45673 | SNYK-JAVA-IONETTY-17261131 | io.netty:netty-resolver-dns | 4.2.6.Final | Generation of Predictable Numbers or Identifiers | 2026-06-08 | 9.0.2 | Upgrade to TopBraid EDG 9.0.2 or later. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-34477 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967727 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Validation of Certificate with Host Mismatch | 2026-04-10 | 9.0.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use SocketAppender, SmtpAppender, or SyslogAppender with TLS should reconfigure to avoid those appenders, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| medium | CVE-2026-2950 | SNYK-JS-LODASH-15869619 | lodash | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASHES-15869621 | lodash-es | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-0540 | SNYK-JS-DOMPURIFY-15371376 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASH-15053838 | lodash | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASHES-15053836 | lodash-es | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2025-59057 | SNYK-JS-REACTROUTER-14908289 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-21884 | SNYK-JS-REACTROUTER-14908293 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-22030 | SNYK-JS-REACTROUTER-14908429 | react-router | 7.6.0 | Cross-site Request Forgery (CSRF) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-68161 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-14532782 | org.apache.logging.log4j:log4j-core | 2.25.2 | Improper Validation of Certificate with Host Mismatch | 2025-12-18 | 9.0.3 | Upgrade to TopBraid EDG 9.0.3 or later. |
| medium | CVE-2025-67735 | SNYK-JAVA-IONETTY-14423947 | io.netty:netty-codec-http | 4.2.6.Final | CRLF Injection | 2025-12-15 | 9.0.4 | Upgrade to TopBraid EDG 9.0.4 or later. |
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 | 9.1.6 | Upgrade to TopBraid EDG 9.1.6 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| low | CVE-2026-22735 | SNYK-JAVA-ORGSPRINGFRAMEWORK-15701755 | org.springframework:spring-web | 6.2.11 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 2026-03-19 | 9.0.3 | Upgrade to TopBraid EDG 9.0.3 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Incomplete List of Disallowed Inputs | 2026-06-23 | 9.0.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Deserialization of Untrusted Data | 2026-06-23 | 9.0.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.2.6.Final | Incorrect Comparison | 2026-06-08 | 9.0.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.6.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.12.2 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.12.2 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.12.2 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.81.1 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40983 | SNYK-JAVA-IOMICROMETER-17339194 | io.micrometer:micrometer-core | 1.15.1 | Allocation of Resources Without Limits or Throttling | 2026-06-09 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305998 | org.springframework.security:spring-security-web | 6.5.5 | User Impersonation | 2026-06-09 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305999 | org.springframework.security:spring-security-config | 6.5.5 | User Impersonation | 2026-06-09 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.15.1 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.11 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.11 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.11 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.14 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.12.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.6.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.12.2 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.12.2 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.12.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42583 | SNYK-JAVA-IONETTY-16438323 | io.netty:netty-codec-compression | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42585 | SNYK-JAVA-IONETTY-16438737 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42584 | SNYK-JAVA-IONETTY-16438923 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438929 | io.netty:netty-codec-http2 | 4.2.6.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438931 | io.netty:netty-codec-compression | 4.2.6.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42581 | SNYK-JAVA-IONETTY-16438934 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42577 | SNYK-JAVA-IONETTY-16438936 | io.netty:netty-transport-classes-epoll | 4.2.6.Final | Missing Release of Resource after Effective Lifetime | 2026-05-06 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.5 | Unsafe Reflection | 2026-05-04 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.5 | XML External Entity (XXE) Injection | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.5 | Memory Allocation with Excessive Size Value | 2026-05-04 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.12.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.12.2 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-22740 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109615 | org.springframework:spring-web | 6.2.11 | Incomplete Cleanup | 2026-04-17 | 9.0.3 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.81 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.81 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 | com.fasterxml.jackson.core:jackson-core | 2.20.0 | Allocation of Resources Without Limits or Throttling | 2026-04-04 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15365924 | com.fasterxml.jackson.core:jackson-core | 2.20.0 | Allocation of Resources Without Limits or Throttling | 2026-02-28 | 9.0.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Server-side Request Forgery (SSRF) | 2026-06-23 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.20.0 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.2.6 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.2.6 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.2.6 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.2.6 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.0 | Inefficient Algorithmic Complexity | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-06-12 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.4 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.2.6.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 9.0.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 6.5.5 | Open Redirect | 2026-06-10 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 6.5.5 | Information Exposure | 2026-06-09 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.2.6.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.2.6.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41715 | SNYK-JAVA-IOPROJECTREACTORNETTY-17260961 | io.projectreactor.netty:reactor-netty-http | 1.2.9 | Cleartext Transmission of Sensitive Information | 2026-06-08 | 9.0.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.11 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.11 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.11 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.11 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.11 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.11 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.12.2 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.12.2 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.12.2 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.12.2 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-42580 | SNYK-JAVA-IONETTY-16438926 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-07 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42578 | SNYK-JAVA-IONETTY-16438935 | io.netty:netty-handler-proxy | 4.2.6.Final | CRLF Injection | 2026-05-07 | 9.0.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41417 | SNYK-JAVA-IONETTY-16425695 | io.netty:netty-codec-http | 4.2.6.Final | HTTP Request Smuggling | 2026-05-05 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.22.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.12.2 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.12.2 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.12.2 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.12.2 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.12.2 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.12.2 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.12.2 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22746 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121176 | org.springframework.security:spring-security-core | 6.5.5 | Information Exposure | 2026-04-22 | 9.0.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22748 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448 | org.springframework.security:spring-security-oauth2-jose | 6.5.5 | Insufficient Verification of Data Authenticity | 2026-04-22 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22751 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16120313 | org.springframework.security:spring-security-core | 6.5.5 | Time-of-check Time-of-use (TOCTOU) Race Condition | 2026-04-21 | 9.0.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22745 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109618 | org.springframework:spring-core | 6.2.11 | Allocation of Resources Without Limits or Throttling | 2026-04-17 | 9.0.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.2.6 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.81 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.12.2 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | (none) | SNYK-JS-DOMPURIFY-15874903 | dompurify | 3.2.6 | Prototype Pollution | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15874905 | dompurify | 3.2.6 | Permissive List of Allowed Inputs | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15810938 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-03-27 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-15599 | SNYK-JS-DOMPURIFY-15371386 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.0 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.2.6 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.2.6 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.9 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.8.4 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASH-15869625 | lodash | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASHES-15869627 | lodash-es | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-25639 | SNYK-JS-AXIOS-15252993 | axios | 1.8.4 | Prototype Pollution | 2026-02-09 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| high | CVE-2025-68470 | SNYK-JS-REACTROUTER-14908286 | react-router | 7.6.0 | Open Redirect | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2026-22029 | SNYK-JS-REACTROUTER-14908531 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2025-55163 | SNYK-JAVA-IOGRPC-13786834 | io.grpc:grpc-netty-shaded | 1.68.0 | Allocation of Resources Without Limits or Throttling | 2025-08-13 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASH-15869619 | lodash | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASHES-15869621 | lodash-es | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-0540 | SNYK-JS-DOMPURIFY-15371376 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASH-15053838 | lodash | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASHES-15053836 | lodash-es | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2025-59057 | SNYK-JS-REACTROUTER-14908289 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-21884 | SNYK-JS-REACTROUTER-14908293 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-22030 | SNYK-JS-REACTROUTER-14908429 | react-router | 7.6.0 | Cross-site Request Forgery (CSRF) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.6.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.8.4 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.8.4 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.8.4 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.81.1 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | CVE-2025-7783 | SNYK-JS-FORMDATA-10841150 | form-data | 4.0.2 | Predictable Value Range from Previous Values | 2025-07-18 | 9.0.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.14.5 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.18 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.18 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.18 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.16 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.8.4 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.6.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.8.4 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.8.4 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.8.4 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.8.4 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.8.4 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.80 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.80 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.22.0 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.2.5 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.2.5 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.2.5 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.2.5 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.2 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41715 | SNYK-JAVA-IOPROJECTREACTORNETTY-17260961 | io.projectreactor.netty:reactor-netty-http | 1.0.48 | Cleartext Transmission of Sensitive Information | 2026-06-08 | 9.0.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.18 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.18 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.18 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.18 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.18 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.18 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.8.4 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.8.4 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.8.4 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.21.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.21.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.8.4 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.8.4 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.8.4 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.8.4 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.8.4 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.2.5 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.80 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.8.4 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | (none) | SNYK-JS-DOMPURIFY-15874903 | dompurify | 3.2.5 | Prototype Pollution | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15874905 | dompurify | 3.2.5 | Permissive List of Allowed Inputs | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15810938 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-03-27 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-15599 | SNYK-JS-DOMPURIFY-15371386 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-58754 | SNYK-JS-AXIOS-12613773 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2025-09-10 | 9.0.0 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.2.5 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2025-22227 | SNYK-JAVA-IOPROJECTREACTORNETTY-10770514 | io.projectreactor.netty:reactor-netty-http | 1.0.48 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | 2025-07-15 | 9.0.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
Previous release was affected, but this one is not.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed |
|---|---|---|---|---|---|---|
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.1.128.Final | Improper Verification of Cryptographic Signature | 2026-06-12 |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 |
| high | CVE-2026-47691 | SNYK-JAVA-IONETTY-17261020 | io.netty:netty-resolver-dns | 4.1.128.Final | Insufficient Verification of Data Authenticity | 2026-06-08 |
| high | CVE-2026-45674 | SNYK-JAVA-IONETTY-17262734 | io.netty:netty-resolver-dns | 4.1.128.Final | Insufficient Verification of Data Authenticity | 2026-06-08 |
| high | CVE-2026-42579 | SNYK-JAVA-IONETTY-16438938 | io.netty:netty-codec-dns | 4.1.128.Final | Null Byte Interaction Error (Poison Null Byte) | 2026-05-07 |
| high | CVE-2026-33870 | SNYK-JAVA-IONETTY-15789756 | io.netty:netty-codec-http | 4.1.128.Final | HTTP Request Smuggling | 2026-03-26 |
| high | CVE-2026-33871 | SNYK-JAVA-IONETTY-15789758 | io.netty:netty-codec-http2 | 4.1.128.Final | Allocation of Resources Without Limits or Throttling | 2026-03-26 |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Cross-site Scripting (XSS) | 2026-06-10 |
| medium | CVE-2026-45673 | SNYK-JAVA-IONETTY-17261131 | io.netty:netty-resolver-dns | 4.1.128.Final | Generation of Predictable Numbers or Identifiers | 2026-06-08 |
| medium | CVE-2025-67735 | SNYK-JAVA-IONETTY-14423947 | io.netty:netty-codec-http | 4.1.128.Final | CRLF Injection | 2025-12-15 |
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.1.128.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-47691 | SNYK-JAVA-IONETTY-17261020 | io.netty:netty-resolver-dns | 4.1.128.Final | Insufficient Verification of Data Authenticity | 2026-06-08 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-45674 | SNYK-JAVA-IONETTY-17262734 | io.netty:netty-resolver-dns | 4.1.128.Final | Insufficient Verification of Data Authenticity | 2026-06-08 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-42579 | SNYK-JAVA-IONETTY-16438938 | io.netty:netty-codec-dns | 4.1.128.Final | Null Byte Interaction Error (Poison Null Byte) | 2026-05-07 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.9 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.8.4 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASH-15869625 | lodash | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASHES-15869627 | lodash-es | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-33870 | SNYK-JAVA-IONETTY-15789756 | io.netty:netty-codec-http | 4.1.128.Final | HTTP Request Smuggling | 2026-03-26 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-33871 | SNYK-JAVA-IONETTY-15789758 | io.netty:netty-codec-http2 | 4.1.128.Final | Allocation of Resources Without Limits or Throttling | 2026-03-26 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-25639 | SNYK-JS-AXIOS-15252993 | axios | 1.8.4 | Prototype Pollution | 2026-02-09 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| high | CVE-2025-68470 | SNYK-JS-REACTROUTER-14908286 | react-router | 7.6.0 | Open Redirect | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2026-22029 | SNYK-JS-REACTROUTER-14908531 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2025-55163 | SNYK-JAVA-IOGRPC-13786834 | io.grpc:grpc-netty-shaded | 1.68.0 | Allocation of Resources Without Limits or Throttling | 2025-08-13 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Cross-site Scripting (XSS) | 2026-06-10 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-45673 | SNYK-JAVA-IONETTY-17261131 | io.netty:netty-resolver-dns | 4.1.128.Final | Generation of Predictable Numbers or Identifiers | 2026-06-08 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASH-15869619 | lodash | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASHES-15869621 | lodash-es | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-0540 | SNYK-JS-DOMPURIFY-15371376 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASH-15053838 | lodash | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASHES-15053836 | lodash-es | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2025-59057 | SNYK-JS-REACTROUTER-14908289 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-21884 | SNYK-JS-REACTROUTER-14908293 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-22030 | SNYK-JS-REACTROUTER-14908429 | react-router | 7.6.0 | Cross-site Request Forgery (CSRF) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-67735 | SNYK-JAVA-IONETTY-14423947 | io.netty:netty-codec-http | 4.1.128.Final | CRLF Injection | 2025-12-15 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.19.1 | Incomplete List of Disallowed Inputs | 2026-06-23 | 8.5.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.19.1 | Deserialization of Untrusted Data | 2026-06-23 | 8.5.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.1.128.Final | Incorrect Comparison | 2026-06-08 | 8.5.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.6.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.8.4 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.8.4 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.8.4 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.81.1 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | CVE-2025-7783 | SNYK-JS-FORMDATA-10841150 | form-data | 4.0.2 | Predictable Value Range from Previous Values | 2025-07-18 | 9.0.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305998 | org.springframework.security:spring-security-web | 6.5.9 | User Impersonation | 2026-06-09 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305999 | org.springframework.security:spring-security-config | 6.5.9 | User Impersonation | 2026-06-09 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.14.5 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.1.128.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.18 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.18 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.18 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.16 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.8.4 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.6.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.8.4 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.8.4 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.8.4 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42583 | SNYK-JAVA-IONETTY-16438322 | io.netty:netty-codec | 4.1.128.Final | Allocation of Resources Without Limits or Throttling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42585 | SNYK-JAVA-IONETTY-16438737 | io.netty:netty-codec-http | 4.1.128.Final | HTTP Request Smuggling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42584 | SNYK-JAVA-IONETTY-16438923 | io.netty:netty-codec-http | 4.1.128.Final | HTTP Request Smuggling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438929 | io.netty:netty-codec-http2 | 4.1.128.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438930 | io.netty:netty-codec | 4.1.128.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42581 | SNYK-JAVA-IONETTY-16438934 | io.netty:netty-codec-http | 4.1.128.Final | HTTP Request Smuggling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.4 | Unsafe Reflection | 2026-05-04 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.4 | XML External Entity (XXE) Injection | 2026-05-04 | 8.5.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.4 | Memory Allocation with Excessive Size Value | 2026-05-04 | 8.5.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.8.4 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.8.4 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.80 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.80 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 | com.fasterxml.jackson.core:jackson-core | 2.19.1 | Allocation of Resources Without Limits or Throttling | 2026-04-04 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15365924 | com.fasterxml.jackson.core:jackson-core | 2.19.1 | Allocation of Resources Without Limits or Throttling | 2026-02-28 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2025-8671 | SNYK-JAVA-ORGAPACHEHTTPCOMPONENTSCORE5-15857052 | org.apache.httpcomponents.core5:httpcore5-h2 | 5.3.4 | Denial of Service (DoS) | 2025-08-13 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.19.1 | Server-side Request Forgery (SSRF) | 2026-06-23 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.19.1 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.2.5 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.2.5 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.2.5 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.2.5 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.0 | Inefficient Algorithmic Complexity | 2026-06-15 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.1.128.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.1.128.Final | HTTP Request Smuggling | 2026-06-12 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.2 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.1.128.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 8.5.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 6.5.9 | Open Redirect | 2026-06-10 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 6.5.9 | Information Exposure | 2026-06-09 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.1.128.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.1.128.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41715 | SNYK-JAVA-IOPROJECTREACTORNETTY-17260961 | io.projectreactor.netty:reactor-netty-http | 1.0.48 | Cleartext Transmission of Sensitive Information | 2026-06-08 | 9.0.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.18 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.18 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.18 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.18 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.18 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.18 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.8.4 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.8.4 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.8.4 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-42580 | SNYK-JAVA-IONETTY-16438926 | io.netty:netty-codec-http | 4.1.128.Final | HTTP Request Smuggling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42578 | SNYK-JAVA-IONETTY-16438935 | io.netty:netty-handler-proxy | 4.1.128.Final | CRLF Injection | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41417 | SNYK-JAVA-IONETTY-16425695 | io.netty:netty-codec-http | 4.1.128.Final | HTTP Request Smuggling | 2026-05-05 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.21.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.21.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.8.4 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.8.4 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.8.4 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.8.4 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.8.4 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22746 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121176 | org.springframework.security:spring-security-core | 6.5.9 | Information Exposure | 2026-04-22 | 8.5.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22748 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448 | org.springframework.security:spring-security-oauth2-jose | 6.5.9 | Insufficient Verification of Data Authenticity | 2026-04-22 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22751 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16120313 | org.springframework.security:spring-security-core | 6.5.9 | Time-of-check Time-of-use (TOCTOU) Race Condition | 2026-04-21 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.2.5 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.80 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.8.4 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | (none) | SNYK-JS-DOMPURIFY-15874903 | dompurify | 3.2.5 | Prototype Pollution | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15874905 | dompurify | 3.2.5 | Permissive List of Allowed Inputs | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15810938 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-03-27 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-15599 | SNYK-JS-DOMPURIFY-15371386 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-58754 | SNYK-JS-AXIOS-12613773 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2025-09-10 | 9.0.0 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.2.5 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2025-22227 | SNYK-JAVA-IOPROJECTREACTORNETTY-10770514 | io.projectreactor.netty:reactor-netty-http | 1.0.48 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | 2025-07-15 | 9.0.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
Previous release was affected, but this one is not.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed |
|---|---|---|---|---|---|---|
| critical | CVE-2026-22732 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-15701796 | org.springframework.security:spring-security-web | 6.5.5 | Use of Cache Containing Sensitive Information | 2026-03-20 |
| high | CVE-2026-34478 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967739 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Output Neutralization for Logs | 2026-04-10 |
| high | CVE-2026-34480 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967769 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Encoding or Escaping of Output | 2026-04-10 |
| high | CVE-2026-34479 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967804 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Encoding or Escaping of Output | 2026-04-10 |
| medium | CVE-2026-34477 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967727 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Validation of Certificate with Host Mismatch | 2026-04-10 |
| medium | CVE-2025-68161 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-14532782 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Validation of Certificate with Host Mismatch | 2025-12-18 |
| low | CVE-2026-22735 | SNYK-JAVA-ORGSPRINGFRAMEWORK-15701755 | org.springframework:spring-web | 6.2.11 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 2026-03-19 |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-22732 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-15701796 | org.springframework.security:spring-security-web | 6.5.5 | Use of Cache Containing Sensitive Information | 2026-03-20 | 8.5.3 | Upgrade to TopBraid EDG 8.5.3, 9.0.3, 9.1.3, or later, when available. |
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.1.128.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.5 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-47691 | SNYK-JAVA-IONETTY-17261020 | io.netty:netty-resolver-dns | 4.1.128.Final | Insufficient Verification of Data Authenticity | 2026-06-08 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-45674 | SNYK-JAVA-IONETTY-17262734 | io.netty:netty-resolver-dns | 4.1.128.Final | Insufficient Verification of Data Authenticity | 2026-06-08 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-42579 | SNYK-JAVA-IONETTY-16438938 | io.netty:netty-codec-dns | 4.1.128.Final | Null Byte Interaction Error (Poison Null Byte) | 2026-05-07 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.9 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-34478 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967739 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Output Neutralization for Logs | 2026-04-10 | 8.5.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Rfc5424Layout with a stream-based syslog appender should reconfigure to avoid Rfc5424Layout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34480 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967769 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Encoding or Escaping of Output | 2026-04-10 | 8.5.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use XmlLayout should reconfigure to avoid XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34479 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967804 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Encoding or Escaping of Output | 2026-04-10 | 8.5.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Log4j1XmlLayout should reconfigure to avoid Log4j1XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.8.4 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASH-15869625 | lodash | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASHES-15869627 | lodash-es | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-33870 | SNYK-JAVA-IONETTY-15789756 | io.netty:netty-codec-http | 4.1.128.Final | HTTP Request Smuggling | 2026-03-26 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-33871 | SNYK-JAVA-IONETTY-15789758 | io.netty:netty-codec-http2 | 4.1.128.Final | Allocation of Resources Without Limits or Throttling | 2026-03-26 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-25639 | SNYK-JS-AXIOS-15252993 | axios | 1.8.4 | Prototype Pollution | 2026-02-09 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| high | CVE-2025-68470 | SNYK-JS-REACTROUTER-14908286 | react-router | 7.6.0 | Open Redirect | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2026-22029 | SNYK-JS-REACTROUTER-14908531 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2025-55163 | SNYK-JAVA-IOGRPC-13786834 | io.grpc:grpc-netty-shaded | 1.68.0 | Allocation of Resources Without Limits or Throttling | 2025-08-13 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.5 | Cross-site Scripting (XSS) | 2026-06-10 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-45673 | SNYK-JAVA-IONETTY-17261131 | io.netty:netty-resolver-dns | 4.1.128.Final | Generation of Predictable Numbers or Identifiers | 2026-06-08 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-34477 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967727 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Validation of Certificate with Host Mismatch | 2026-04-10 | 8.5.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use SocketAppender, SmtpAppender, or SyslogAppender with TLS should reconfigure to avoid those appenders, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| medium | CVE-2026-2950 | SNYK-JS-LODASH-15869619 | lodash | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASHES-15869621 | lodash-es | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-0540 | SNYK-JS-DOMPURIFY-15371376 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASH-15053838 | lodash | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASHES-15053836 | lodash-es | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2025-59057 | SNYK-JS-REACTROUTER-14908289 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-21884 | SNYK-JS-REACTROUTER-14908293 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-22030 | SNYK-JS-REACTROUTER-14908429 | react-router | 7.6.0 | Cross-site Request Forgery (CSRF) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-68161 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-14532782 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Validation of Certificate with Host Mismatch | 2025-12-18 | 8.5.3 | Upgrade to TopBraid EDG 8.5.3 or later. |
| medium | CVE-2025-67735 | SNYK-JAVA-IONETTY-14423947 | io.netty:netty-codec-http | 4.1.128.Final | CRLF Injection | 2025-12-15 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| low | CVE-2026-22735 | SNYK-JAVA-ORGSPRINGFRAMEWORK-15701755 | org.springframework:spring-web | 6.2.11 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 2026-03-19 | 8.5.3 | Upgrade to TopBraid EDG 8.5.3 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.19.1 | Incomplete List of Disallowed Inputs | 2026-06-23 | 8.5.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.19.1 | Deserialization of Untrusted Data | 2026-06-23 | 8.5.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.1.128.Final | Incorrect Comparison | 2026-06-08 | 8.5.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.6.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.8.4 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.8.4 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.8.4 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.81.1 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | CVE-2025-7783 | SNYK-JS-FORMDATA-10841150 | form-data | 4.0.2 | Predictable Value Range from Previous Values | 2025-07-18 | 9.0.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305998 | org.springframework.security:spring-security-web | 6.5.5 | User Impersonation | 2026-06-09 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305999 | org.springframework.security:spring-security-config | 6.5.5 | User Impersonation | 2026-06-09 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.14.5 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.1.128.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.11 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.11 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.11 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.14 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.8.4 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.6.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.8.4 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.8.4 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.8.4 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42583 | SNYK-JAVA-IONETTY-16438322 | io.netty:netty-codec | 4.1.128.Final | Allocation of Resources Without Limits or Throttling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42585 | SNYK-JAVA-IONETTY-16438737 | io.netty:netty-codec-http | 4.1.128.Final | HTTP Request Smuggling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42584 | SNYK-JAVA-IONETTY-16438923 | io.netty:netty-codec-http | 4.1.128.Final | HTTP Request Smuggling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438929 | io.netty:netty-codec-http2 | 4.1.128.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438930 | io.netty:netty-codec | 4.1.128.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42581 | SNYK-JAVA-IONETTY-16438934 | io.netty:netty-codec-http | 4.1.128.Final | HTTP Request Smuggling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.4 | Unsafe Reflection | 2026-05-04 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.4 | XML External Entity (XXE) Injection | 2026-05-04 | 8.5.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.4 | Memory Allocation with Excessive Size Value | 2026-05-04 | 8.5.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.8.4 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.8.4 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-22740 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109615 | org.springframework:spring-web | 6.2.11 | Incomplete Cleanup | 2026-04-17 | 8.5.3 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.80 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.80 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 | com.fasterxml.jackson.core:jackson-core | 2.19.1 | Allocation of Resources Without Limits or Throttling | 2026-04-04 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15365924 | com.fasterxml.jackson.core:jackson-core | 2.19.1 | Allocation of Resources Without Limits or Throttling | 2026-02-28 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2025-8671 | SNYK-JAVA-ORGAPACHEHTTPCOMPONENTSCORE5-15857052 | org.apache.httpcomponents.core5:httpcore5-h2 | 5.3.4 | Denial of Service (DoS) | 2025-08-13 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.19.1 | Server-side Request Forgery (SSRF) | 2026-06-23 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.19.1 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.2.5 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.2.5 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.2.5 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.2.5 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.0 | Inefficient Algorithmic Complexity | 2026-06-15 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.1.128.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.1.128.Final | HTTP Request Smuggling | 2026-06-12 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.2 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.1.128.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 8.5.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 6.5.5 | Open Redirect | 2026-06-10 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 6.5.5 | Information Exposure | 2026-06-09 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.1.128.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.1.128.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41715 | SNYK-JAVA-IOPROJECTREACTORNETTY-17260961 | io.projectreactor.netty:reactor-netty-http | 1.0.48 | Cleartext Transmission of Sensitive Information | 2026-06-08 | 9.0.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.11 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.11 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.11 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.11 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.11 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.11 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.8.4 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.8.4 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.8.4 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-42580 | SNYK-JAVA-IONETTY-16438926 | io.netty:netty-codec-http | 4.1.128.Final | HTTP Request Smuggling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42578 | SNYK-JAVA-IONETTY-16438935 | io.netty:netty-handler-proxy | 4.1.128.Final | CRLF Injection | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41417 | SNYK-JAVA-IONETTY-16425695 | io.netty:netty-codec-http | 4.1.128.Final | HTTP Request Smuggling | 2026-05-05 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.21.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.21.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.8.4 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.8.4 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.8.4 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.8.4 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.8.4 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22746 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121176 | org.springframework.security:spring-security-core | 6.5.5 | Information Exposure | 2026-04-22 | 8.5.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22748 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448 | org.springframework.security:spring-security-oauth2-jose | 6.5.5 | Insufficient Verification of Data Authenticity | 2026-04-22 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22751 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16120313 | org.springframework.security:spring-security-core | 6.5.5 | Time-of-check Time-of-use (TOCTOU) Race Condition | 2026-04-21 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22745 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109618 | org.springframework:spring-core | 6.2.11 | Allocation of Resources Without Limits or Throttling | 2026-04-17 | 8.5.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.2.5 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.80 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.8.4 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | (none) | SNYK-JS-DOMPURIFY-15874903 | dompurify | 3.2.5 | Prototype Pollution | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15874905 | dompurify | 3.2.5 | Permissive List of Allowed Inputs | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15810938 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-03-27 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-15599 | SNYK-JS-DOMPURIFY-15371386 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-58754 | SNYK-JS-AXIOS-12613773 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2025-09-10 | 9.0.0 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.2.5 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2025-22227 | SNYK-JAVA-IOPROJECTREACTORNETTY-10770514 | io.projectreactor.netty:reactor-netty-http | 1.0.48 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | 2025-07-15 | 9.0.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
Previous release was affected, but this one is not.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed |
|---|---|---|---|---|---|---|
| high | CVE-2025-41249 | SNYK-JAVA-ORGSPRINGFRAMEWORK-12817817 | org.springframework:spring-core | 6.2.8 | Incorrect Authorization | 2025-09-16 |
| high | CVE-2025-58056 | SNYK-JAVA-IONETTY-12485149 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2025-09-03 |
| high | CVE-2025-58057 | SNYK-JAVA-IONETTY-12485150 | io.netty:netty-codec-http | 4.1.118.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2025-09-03 |
| high | CVE-2025-58057 | SNYK-JAVA-IONETTY-12485151 | io.netty:netty-codec-http2 | 4.1.118.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2025-09-03 |
| high | CVE-2025-54988 | SNYK-JAVA-ORGAPACHETIKA-12238980 | org.apache.tika:tika-parser-pdf-module | 3.2.0 | XML External Entity (XXE) Injection | 2025-08-20 |
| high | CVE-2025-54988 | SNYK-JAVA-ORGAPACHETIKA-14188255 | org.apache.tika:tika-core | 3.2.0 | XML External Entity (XXE) Injection | 2025-08-20 |
| high | CVE-2025-41242 | SNYK-JAVA-ORGSPRINGFRAMEWORK-12008931 | org.springframework:spring-beans | 6.2.8 | Relative Path Traversal | 2025-08-14 |
| high | CVE-2025-55163 | SNYK-JAVA-IONETTY-11799531 | io.netty:netty-codec-http2 | 4.1.118.Final | Allocation of Resources Without Limits or Throttling | 2025-08-13 |
| medium | CVE-2025-7962 | SNYK-JAVA-ORGECLIPSEANGUS-12239873 | org.eclipse.angus:angus-mail | 2.0.3 | Improper Neutralization | 2025-07-21 |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-22732 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-15701796 | org.springframework.security:spring-security-web | 6.5.1 | Use of Cache Containing Sensitive Information | 2026-03-20 | 8.5.3 | Upgrade to TopBraid EDG 8.5.3, 9.0.3, 9.1.3, or later, when available. |
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.1.119.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.1 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-47691 | SNYK-JAVA-IONETTY-17261020 | io.netty:netty-resolver-dns | 4.1.112.Final | Insufficient Verification of Data Authenticity | 2026-06-08 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-45674 | SNYK-JAVA-IONETTY-17262734 | io.netty:netty-resolver-dns | 4.1.112.Final | Insufficient Verification of Data Authenticity | 2026-06-08 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-42579 | SNYK-JAVA-IONETTY-16438938 | io.netty:netty-codec-dns | 4.1.112.Final | Null Byte Interaction Error (Poison Null Byte) | 2026-05-07 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.9 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-34478 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967739 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Output Neutralization for Logs | 2026-04-10 | 8.5.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Rfc5424Layout with a stream-based syslog appender should reconfigure to avoid Rfc5424Layout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34480 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967769 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Encoding or Escaping of Output | 2026-04-10 | 8.5.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use XmlLayout should reconfigure to avoid XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34479 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967804 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Encoding or Escaping of Output | 2026-04-10 | 8.5.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Log4j1XmlLayout should reconfigure to avoid Log4j1XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.8.4 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASH-15869625 | lodash | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASHES-15869627 | lodash-es | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-33870 | SNYK-JAVA-IONETTY-15789756 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2026-03-26 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-33871 | SNYK-JAVA-IONETTY-15789758 | io.netty:netty-codec-http2 | 4.1.118.Final | Allocation of Resources Without Limits or Throttling | 2026-03-26 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-25639 | SNYK-JS-AXIOS-15252993 | axios | 1.8.4 | Prototype Pollution | 2026-02-09 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| high | CVE-2025-68470 | SNYK-JS-REACTROUTER-14908286 | react-router | 7.6.0 | Open Redirect | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2026-22029 | SNYK-JS-REACTROUTER-14908531 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2025-41249 | SNYK-JAVA-ORGSPRINGFRAMEWORK-12817817 | org.springframework:spring-core | 6.2.8 | Incorrect Authorization | 2025-09-16 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| high | CVE-2025-58056 | SNYK-JAVA-IONETTY-12485149 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2025-09-03 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| high | CVE-2025-58057 | SNYK-JAVA-IONETTY-12485150 | io.netty:netty-codec-http | 4.1.118.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2025-09-03 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| high | CVE-2025-58057 | SNYK-JAVA-IONETTY-12485151 | io.netty:netty-codec-http2 | 4.1.118.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2025-09-03 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| high | CVE-2025-54988 | SNYK-JAVA-ORGAPACHETIKA-12238980 | org.apache.tika:tika-parser-pdf-module | 3.2.0 | XML External Entity (XXE) Injection | 2025-08-20 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| high | CVE-2025-54988 | SNYK-JAVA-ORGAPACHETIKA-14188255 | org.apache.tika:tika-core | 3.2.0 | XML External Entity (XXE) Injection | 2025-08-20 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| high | CVE-2025-41242 | SNYK-JAVA-ORGSPRINGFRAMEWORK-12008931 | org.springframework:spring-beans | 6.2.8 | Relative Path Traversal | 2025-08-14 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| high | CVE-2025-55163 | SNYK-JAVA-IOGRPC-13786834 | io.grpc:grpc-netty-shaded | 1.68.0 | Allocation of Resources Without Limits or Throttling | 2025-08-13 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2025-55163 | SNYK-JAVA-IONETTY-11799531 | io.netty:netty-codec-http2 | 4.1.118.Final | Allocation of Resources Without Limits or Throttling | 2025-08-13 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.1 | Cross-site Scripting (XSS) | 2026-06-10 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-45673 | SNYK-JAVA-IONETTY-17261131 | io.netty:netty-resolver-dns | 4.1.112.Final | Generation of Predictable Numbers or Identifiers | 2026-06-08 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-34477 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967727 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Validation of Certificate with Host Mismatch | 2026-04-10 | 8.5.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use SocketAppender, SmtpAppender, or SyslogAppender with TLS should reconfigure to avoid those appenders, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| medium | CVE-2026-2950 | SNYK-JS-LODASH-15869619 | lodash | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASHES-15869621 | lodash-es | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-0540 | SNYK-JS-DOMPURIFY-15371376 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASH-15053838 | lodash | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASHES-15053836 | lodash-es | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2025-59057 | SNYK-JS-REACTROUTER-14908289 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-21884 | SNYK-JS-REACTROUTER-14908293 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-22030 | SNYK-JS-REACTROUTER-14908429 | react-router | 7.6.0 | Cross-site Request Forgery (CSRF) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-68161 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-14532782 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Validation of Certificate with Host Mismatch | 2025-12-18 | 8.5.3 | Upgrade to TopBraid EDG 8.5.3 or later. |
| medium | CVE-2025-67735 | SNYK-JAVA-IONETTY-14423947 | io.netty:netty-codec-http | 4.1.118.Final | CRLF Injection | 2025-12-15 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| medium | CVE-2025-7962 | SNYK-JAVA-ORGECLIPSEANGUS-12239873 | org.eclipse.angus:angus-mail | 2.0.3 | Improper Neutralization | 2025-07-21 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| low | CVE-2026-22735 | SNYK-JAVA-ORGSPRINGFRAMEWORK-15701755 | org.springframework:spring-web | 6.2.8 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 2026-03-19 | 8.5.3 | Upgrade to TopBraid EDG 8.5.3 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.19.1 | Incomplete List of Disallowed Inputs | 2026-06-23 | 8.5.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.19.1 | Deserialization of Untrusted Data | 2026-06-23 | 8.5.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.1.119.Final | Incorrect Comparison | 2026-06-08 | 8.5.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.6.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.8.4 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.8.4 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.8.4 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.80.2 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | CVE-2025-7783 | SNYK-JS-FORMDATA-10841150 | form-data | 4.0.2 | Predictable Value Range from Previous Values | 2025-07-18 | 9.0.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305998 | org.springframework.security:spring-security-web | 6.5.1 | User Impersonation | 2026-06-09 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305999 | org.springframework.security:spring-security-config | 6.5.1 | User Impersonation | 2026-06-09 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.14.5 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.1.119.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.8 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.8 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.8 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.12 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.8.4 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.6.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.8.4 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.8.4 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.8.4 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42583 | SNYK-JAVA-IONETTY-16438322 | io.netty:netty-codec | 4.1.118.Final | Allocation of Resources Without Limits or Throttling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42585 | SNYK-JAVA-IONETTY-16438737 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42584 | SNYK-JAVA-IONETTY-16438923 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438929 | io.netty:netty-codec-http2 | 4.1.118.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438930 | io.netty:netty-codec | 4.1.118.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42581 | SNYK-JAVA-IONETTY-16438934 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.4 | Unsafe Reflection | 2026-05-04 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.4 | XML External Entity (XXE) Injection | 2026-05-04 | 8.5.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.4 | Memory Allocation with Excessive Size Value | 2026-05-04 | 8.5.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.8.4 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.8.4 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-22740 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109615 | org.springframework:spring-web | 6.2.8 | Incomplete Cleanup | 2026-04-17 | 8.5.3 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.80 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.80 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 | com.fasterxml.jackson.core:jackson-core | 2.19.1 | Allocation of Resources Without Limits or Throttling | 2026-04-04 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15365924 | com.fasterxml.jackson.core:jackson-core | 2.19.1 | Allocation of Resources Without Limits or Throttling | 2026-02-28 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2025-41248 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-12817818 | org.springframework.security:spring-security-core | 6.5.1 | Incorrect Authorization | 2025-09-16 | 8.5.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-8671 | SNYK-JAVA-ORGAPACHEHTTPCOMPONENTSCORE5-15857052 | org.apache.httpcomponents.core5:httpcore5-h2 | 5.3.4 | Denial of Service (DoS) | 2025-08-13 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.19.1 | Server-side Request Forgery (SSRF) | 2026-06-23 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.19.1 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.2.5 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.2.5 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.2.5 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.2.5 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.0 | Inefficient Algorithmic Complexity | 2026-06-15 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.1.118.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2026-06-12 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.2 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.1.118.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 8.5.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 6.5.1 | Open Redirect | 2026-06-10 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 6.5.1 | Information Exposure | 2026-06-09 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.1.118.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.1.118.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41715 | SNYK-JAVA-IOPROJECTREACTORNETTY-17260961 | io.projectreactor.netty:reactor-netty-http | 1.0.48 | Cleartext Transmission of Sensitive Information | 2026-06-08 | 9.0.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.8 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.8 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.8 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.8 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.8 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.8 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.8.4 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.8.4 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.8.4 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-42580 | SNYK-JAVA-IONETTY-16438926 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42578 | SNYK-JAVA-IONETTY-16438935 | io.netty:netty-handler-proxy | 4.1.118.Final | CRLF Injection | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41417 | SNYK-JAVA-IONETTY-16425695 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2026-05-05 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.21.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.21.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.8.4 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.8.4 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.8.4 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.8.4 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.8.4 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22746 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121176 | org.springframework.security:spring-security-core | 6.5.1 | Information Exposure | 2026-04-22 | 8.5.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22748 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448 | org.springframework.security:spring-security-oauth2-jose | 6.5.1 | Insufficient Verification of Data Authenticity | 2026-04-22 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22751 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16120313 | org.springframework.security:spring-security-core | 6.5.1 | Time-of-check Time-of-use (TOCTOU) Race Condition | 2026-04-21 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22745 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109618 | org.springframework:spring-core | 6.2.8 | Allocation of Resources Without Limits or Throttling | 2026-04-17 | 8.5.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.2.5 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.80 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.8.4 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | (none) | SNYK-JS-DOMPURIFY-15874903 | dompurify | 3.2.5 | Prototype Pollution | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15874905 | dompurify | 3.2.5 | Permissive List of Allowed Inputs | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15810938 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-03-27 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-15599 | SNYK-JS-DOMPURIFY-15371386 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-58754 | SNYK-JS-AXIOS-12613773 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2025-09-10 | 9.0.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-53864 | SNYK-JAVA-COMNIMBUSDS-10691768 | com.nimbusds:nimbus-jose-jwt | 9.37.3 | Uncontrolled Recursion | 2025-07-11 | 8.5.2 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.2.5 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2025-22227 | SNYK-JAVA-IOPROJECTREACTORNETTY-10770514 | io.projectreactor.netty:reactor-netty-http | 1.0.48 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | 2025-07-15 | 9.0.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
The product is exposed and action should be taken.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Action statement |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-22732 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-15701796 | org.springframework.security:spring-security-web | 6.5.1 | Use of Cache Containing Sensitive Information | 2026-03-20 | 8.5.3 | Upgrade to TopBraid EDG 8.5.3, 9.0.3, 9.1.3, or later, when available. |
| high | CVE-2026-50010 | SNYK-JAVA-IONETTY-17334567 | io.netty:netty-handler | 4.1.119.Final | Improper Verification of Cryptographic Signature | 2026-06-12 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-40988 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633 | org.springframework.security:spring-security-saml2-service-provider | 6.5.1 | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-06-10 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| high | CVE-2026-47691 | SNYK-JAVA-IONETTY-17261020 | io.netty:netty-resolver-dns | 4.1.112.Final | Insufficient Verification of Data Authenticity | 2026-06-08 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-45674 | SNYK-JAVA-IONETTY-17262734 | io.netty:netty-resolver-dns | 4.1.112.Final | Insufficient Verification of Data Authenticity | 2026-06-08 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-42579 | SNYK-JAVA-IONETTY-16438938 | io.netty:netty-codec-dns | 4.1.112.Final | Null Byte Interaction Error (Poison Null Byte) | 2026-05-07 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-40895 | SNYK-JS-FOLLOWREDIRECTS-16032162 | follow-redirects | 1.15.9 | Improper Removal of Sensitive Information Before Storage or Transfer | 2026-04-14 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-34478 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967739 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Output Neutralization for Logs | 2026-04-10 | 8.5.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Rfc5424Layout with a stream-based syslog appender should reconfigure to avoid Rfc5424Layout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34480 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967769 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Encoding or Escaping of Output | 2026-04-10 | 8.5.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use XmlLayout should reconfigure to avoid XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-34479 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967804 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Encoding or Escaping of Output | 2026-04-10 | 8.5.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use Log4j1XmlLayout should reconfigure to avoid Log4j1XmlLayout, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| high | CVE-2026-40175 | SNYK-JS-AXIOS-15969258 | axios | 1.8.4 | HTTP Response Splitting | 2026-04-10 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASH-15869625 | lodash | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-4800 | SNYK-JS-LODASHES-15869627 | lodash-es | 4.17.21 | Arbitrary Code Injection | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| high | CVE-2026-33870 | SNYK-JAVA-IONETTY-15789756 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2026-03-26 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-33871 | SNYK-JAVA-IONETTY-15789758 | io.netty:netty-codec-http2 | 4.1.118.Final | Allocation of Resources Without Limits or Throttling | 2026-03-26 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| high | CVE-2026-25639 | SNYK-JS-AXIOS-15252993 | axios | 1.8.4 | Prototype Pollution | 2026-02-09 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| high | CVE-2025-68470 | SNYK-JS-REACTROUTER-14908286 | react-router | 7.6.0 | Open Redirect | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2026-22029 | SNYK-JS-REACTROUTER-14908531 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2025-41249 | SNYK-JAVA-ORGSPRINGFRAMEWORK-12817817 | org.springframework:spring-core | 6.2.8 | Incorrect Authorization | 2025-09-16 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| high | CVE-2025-58056 | SNYK-JAVA-IONETTY-12485149 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2025-09-03 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| high | CVE-2025-58057 | SNYK-JAVA-IONETTY-12485150 | io.netty:netty-codec-http | 4.1.118.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2025-09-03 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| high | CVE-2025-58057 | SNYK-JAVA-IONETTY-12485151 | io.netty:netty-codec-http2 | 4.1.118.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2025-09-03 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| high | CVE-2025-54988 | SNYK-JAVA-ORGAPACHETIKA-12238980 | org.apache.tika:tika-parser-pdf-module | 3.2.0 | XML External Entity (XXE) Injection | 2025-08-20 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| high | CVE-2025-54988 | SNYK-JAVA-ORGAPACHETIKA-14188255 | org.apache.tika:tika-core | 3.2.0 | XML External Entity (XXE) Injection | 2025-08-20 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| high | CVE-2025-41242 | SNYK-JAVA-ORGSPRINGFRAMEWORK-12008931 | org.springframework:spring-beans | 6.2.8 | Relative Path Traversal | 2025-08-14 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| high | CVE-2025-55163 | SNYK-JAVA-IOGRPC-13786834 | io.grpc:grpc-netty-shaded | 1.68.0 | Allocation of Resources Without Limits or Throttling | 2025-08-13 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| high | CVE-2025-55163 | SNYK-JAVA-IONETTY-11799531 | io.netty:netty-codec-http2 | 4.1.118.Final | Allocation of Resources Without Limits or Throttling | 2025-08-13 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| medium | CVE-2026-41003 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632 | org.springframework.security:spring-security-saml2-service-provider | 6.5.1 | Cross-site Scripting (XSS) | 2026-06-10 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4, 9.0.4, 9.1.7, 9.2.2, or later, when available. |
| medium | CVE-2026-45673 | SNYK-JAVA-IONETTY-17261131 | io.netty:netty-resolver-dns | 4.1.112.Final | Generation of Predictable Numbers or Identifiers | 2026-06-08 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| medium | CVE-2026-47761 | SNYK-JS-TINYMCE-17056137 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47762 | SNYK-JS-TINYMCE-17056141 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-47759 | SNYK-JS-TINYMCE-17056166 | tinymce | 7.5.1 | Cross-site Scripting (XSS) | 2026-05-28 | 9.2.2 | Upgrade to TopBraid EDG 9.2.2 or later. |
| medium | CVE-2026-34477 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-15967727 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Validation of Certificate with Host Mismatch | 2026-04-10 | 8.5.3 | The default configuration is not exposed. Customers who have customised their Log4j configuration to use SocketAppender, SmtpAppender, or SyslogAppender with TLS should reconfigure to avoid those appenders, or upgrade to TopBraid EDG 9.2.0, 9.1.5, 9.0.3, 8.5.3, or 8.4.3, all scheduled for release in May 2026. |
| medium | CVE-2026-2950 | SNYK-JS-LODASH-15869619 | lodash | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-2950 | SNYK-JS-LODASHES-15869621 | lodash-es | 4.17.21 | Prototype Pollution | 2026-03-31 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2026-0540 | SNYK-JS-DOMPURIFY-15371376 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.3 | Upgrade to TopBraid EDG 9.1.3 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASH-15053838 | lodash | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-13465 | SNYK-JS-LODASHES-15053836 | lodash-es | 4.17.21 | Prototype Pollution | 2026-01-21 | 9.1.4 | Upgrade to TopBraid EDG 9.1.4 or later. |
| medium | CVE-2025-59057 | SNYK-JS-REACTROUTER-14908289 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-21884 | SNYK-JS-REACTROUTER-14908293 | react-router | 7.6.0 | Cross-site Scripting (XSS) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2026-22030 | SNYK-JS-REACTROUTER-14908429 | react-router | 7.6.0 | Cross-site Request Forgery (CSRF) | 2026-01-08 | 9.1.0 | Upgrade to TopBraid EDG 9.1.0 or later. |
| medium | CVE-2025-68161 | SNYK-JAVA-ORGAPACHELOGGINGLOG4J-14532782 | org.apache.logging.log4j:log4j-core | 2.24.3 | Improper Validation of Certificate with Host Mismatch | 2025-12-18 | 8.5.3 | Upgrade to TopBraid EDG 8.5.3 or later. |
| medium | CVE-2025-67735 | SNYK-JAVA-IONETTY-14423947 | io.netty:netty-codec-http | 4.1.118.Final | CRLF Injection | 2025-12-15 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| medium | CVE-2025-7962 | SNYK-JAVA-ORGECLIPSEANGUS-12239873 | org.eclipse.angus:angus-mail | 2.0.3 | Improper Neutralization | 2025-07-21 | 8.5.2 | Upgrade to TopBraid EDG 8.5.2 or later. |
| medium | CVE-2026-2327 | SNYK-JS-MARKDOWNIT-10666750 | markdown-it | 14.1.0 | Regular Expression Denial of Service (ReDoS) | 2025-07-05 | 8.5.4 | Upgrade to TopBraid EDG 8.5.4 or later. |
| medium | CVE-2025-6493 | SNYK-JS-CODEMIRROR-10494092 | codemirror | 5.65.18 | Regular Expression Denial of Service (ReDoS) | 2025-06-22 | 9.2.0 | Upgrade to TopBraid EDG 9.2.0 or later. |
| low | CVE-2026-22735 | SNYK-JAVA-ORGSPRINGFRAMEWORK-15701755 | org.springframework:spring-web | 6.2.8 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 2026-03-19 | 8.5.3 | Upgrade to TopBraid EDG 8.5.3 or later. |
Component present in the product, but not exploitable.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed | Fixed in | Justification |
|---|---|---|---|---|---|---|---|---|
| critical | CVE-2026-54513 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366 | com.fasterxml.jackson.core:jackson-databind | 2.19.1 | Incomplete List of Disallowed Inputs | 2026-06-23 | 8.5.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-54512 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598 | com.fasterxml.jackson.core:jackson-databind | 2.19.1 | Deserialization of Untrusted Data | 2026-06-23 | 8.5.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-44249 | SNYK-JAVA-IONETTY-17254120 | io.netty:netty-handler | 4.1.119.Final | Incorrect Comparison | 2026-06-08 | 8.5.4 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42211 | SNYK-JS-REACTROUTER-17137394 | react-router | 7.6.0 | Deserialization of Untrusted Data | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| critical | CVE-2026-42264 | SNYK-JS-AXIOS-16417750 | axios | 1.8.4 | Prototype Pollution | 2026-05-05 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42035 | SNYK-JS-AXIOS-16298058 | axios | 1.8.4 | HTTP Response Splitting | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-42033 | SNYK-JS-AXIOS-16299904 | axios | 1.8.4 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| critical | CVE-2026-5588 | SNYK-JAVA-ORGBOUNCYCASTLE-16075260 | org.bouncycastle:bcpkix-jdk18on | 1.80.2 | Improper Verification of Cryptographic Signature | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| critical | CVE-2025-7783 | SNYK-JS-FORMDATA-10841150 | form-data | 4.0.2 | Predictable Value Range from Previous Values | 2025-07-18 | 9.0.0 | vulnerable_code_not_in_execute_path |
| critical | (none) | SNYK-JS-JQUERYFORM-574783 | jquery-form | 3.50.0 | Cross-site Scripting (XSS) | 2015-04-10 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305998 | org.springframework.security:spring-security-web | 6.5.1 | User Impersonation | 2026-06-09 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-47838 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17305999 | org.springframework.security:spring-security-config | 6.5.1 | User Impersonation | 2026-06-09 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40984 | SNYK-JAVA-IOMICROMETER-17260885 | io.micrometer:micrometer-core | 1.14.5 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45416 | SNYK-JAVA-IONETTY-17254117 | io.netty:netty-handler | 4.1.119.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-41850 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253311 | org.springframework:spring-expression | 6.2.8 | Inefficient Algorithmic Complexity | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41840 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253520 | org.springframework:spring-web | 6.2.8 | Missing Release of Memory after Effective Lifetime | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41851 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255206 | org.springframework:spring-core | 6.2.8 | Allocation of Resources Without Limits or Throttling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-41720 | SNYK-JAVA-ORGSPRINGFRAMEWORKLDAP-17260845 | org.springframework.ldap:spring-ldap-core | 3.2.12 | Incorrect Implementation of Authentication Algorithm | 2026-06-08 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44486 | SNYK-JS-AXIOS-17172681 | axios | 1.8.4 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42342 | SNYK-JS-REACTROUTER-17138701 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-34077 | SNYK-JS-REACTROUTER-17138883 | react-router | 7.6.0 | Allocation of Resources Without Limits or Throttling | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40181 | SNYK-JS-REACTROUTER-17138887 | react-router | 7.6.0 | Open Redirect | 2026-06-02 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-44495 | SNYK-JS-AXIOS-17111060 | axios | 1.8.4 | Prototype Pollution | 2026-05-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-44492 | SNYK-JS-AXIOS-17111062 | axios | 1.8.4 | Server-side Request Forgery (SSRF) | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-44494 | SNYK-JS-AXIOS-17111079 | axios | 1.8.4 | Prototype Pollution | 2026-05-29 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-45292 | SNYK-JAVA-IOOPENTELEMETRY-17280222 | io.opentelemetry:opentelemetry-api | 1.42.1 | Allocation of Resources Without Limits or Throttling | 2026-05-28 | vulnerable_code_not_in_execute_path | |
| high | CVE-2026-42583 | SNYK-JAVA-IONETTY-16438322 | io.netty:netty-codec | 4.1.118.Final | Allocation of Resources Without Limits or Throttling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42585 | SNYK-JAVA-IONETTY-16438737 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42584 | SNYK-JAVA-IONETTY-16438923 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438929 | io.netty:netty-codec-http2 | 4.1.118.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42587 | SNYK-JAVA-IONETTY-16438930 | io.netty:netty-codec | 4.1.118.Final | Improper Handling of Highly Compressed Data (Data Amplification) | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42581 | SNYK-JAVA-IONETTY-16438934 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-42027 | SNYK-JAVA-ORGAPACHEOPENNLP-16419373 | org.apache.opennlp:opennlp-tools | 2.5.4 | Unsafe Reflection | 2026-05-04 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-40682 | SNYK-JAVA-ORGAPACHEOPENNLP-16419377 | org.apache.opennlp:opennlp-tools | 2.5.4 | XML External Entity (XXE) Injection | 2026-05-04 | 8.5.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42440 | SNYK-JAVA-ORGAPACHEOPENNLP-16535521 | org.apache.opennlp:opennlp-tools | 2.5.4 | Memory Allocation with Excessive Size Value | 2026-05-04 | 8.5.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42044 | SNYK-JS-AXIOS-16299921 | axios | 1.8.4 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| high | CVE-2026-42039 | SNYK-JS-AXIOS-16299923 | axios | 1.8.4 | Uncontrolled Recursion | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-22740 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109615 | org.springframework:spring-web | 6.2.8 | Incomplete Cleanup | 2026-04-17 | 8.5.3 | vulnerable_code_not_in_execute_path |
| high | CVE-2026-5598 | SNYK-JAVA-ORGBOUNCYCASTLE-16074612 | org.bouncycastle:bcprov-jdk18on | 1.80 | Timing Attack | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-14813 | SNYK-JAVA-ORGBOUNCYCASTLE-16075266 | org.bouncycastle:bcprov-jdk18on | 1.80 | Use of a Broken or Risky Cryptographic Algorithm | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 | com.fasterxml.jackson.core:jackson-core | 2.19.1 | Allocation of Resources Without Limits or Throttling | 2026-04-04 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | (none) | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15365924 | com.fasterxml.jackson.core:jackson-core | 2.19.1 | Allocation of Resources Without Limits or Throttling | 2026-02-28 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-68280 | SNYK-JAVA-ORGAPACHESISCORE-14874786 | org.apache.sis.core:sis-metadata | 1.4 | XML External Entity (XXE) Injection | 2026-01-05 | vulnerable_code_not_in_execute_path | |
| high | CVE-2025-41248 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-12817818 | org.springframework.security:spring-security-core | 6.5.1 | Incorrect Authorization | 2025-09-16 | 8.5.2 | vulnerable_code_not_in_execute_path |
| high | CVE-2025-8671 | SNYK-JAVA-ORGAPACHEHTTPCOMPONENTSCORE5-15857052 | org.apache.httpcomponents.core5:httpcore5-h2 | 5.3.4 | Denial of Service (DoS) | 2025-08-13 | 8.5.4 | vulnerable_code_not_in_execute_path |
| high | CVE-2021-23370 | SNYK-JS-SWIPER-1088062 | swiper | 3.4.1 | Prototype Pollution | 2021-03-22 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54514 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17434790 | com.fasterxml.jackson.core:jackson-databind | 2.19.1 | Server-side Request Forgery (SSRF) | 2026-06-23 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-54515 | SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695 | com.fasterxml.jackson.core:jackson-databind | 2.19.1 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 2026-06-23 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17375136 | dompurify | 3.2.5 | Improper Initialization | 2026-06-18 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17342528 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49978 | SNYK-JS-DOMPURIFY-17344504 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344516 | dompurify | 3.2.5 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49458 | SNYK-JS-DOMPURIFY-17344526 | dompurify | 3.2.5 | Trust Boundary Violation | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-49459 | SNYK-JS-DOMPURIFY-17344538 | dompurify | 3.2.5 | Prototype Pollution | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | (none) | SNYK-JS-DOMPURIFY-17344549 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48988 | SNYK-JS-MARKDOWNIT-17353909 | markdown-it | 14.1.0 | Inefficient Algorithmic Complexity | 2026-06-15 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50560 | SNYK-JAVA-IONETTY-17337010 | io.netty:netty-codec-http2 | 4.1.118.Final | Allocation of Resources Without Limits or Throttling | 2026-06-12 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-50020 | SNYK-JAVA-IONETTY-17337012 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2026-06-12 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-12143 | SNYK-JS-FORMDATA-17337015 | form-data | 4.0.2 | CRLF Injection | 2026-06-12 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-48043 | SNYK-JAVA-IONETTY-17311220 | io.netty:netty-codec-http2 | 4.1.118.Final | Missing Release of Memory after Effective Lifetime | 2026-06-11 | 8.5.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-41706 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17314598 | org.springframework.security:spring-security-web | 6.5.1 | Open Redirect | 2026-06-10 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41694 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750 | org.springframework.security:spring-security-saml2-service-provider | 6.5.1 | Information Exposure | 2026-06-09 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-47244 | SNYK-JAVA-IONETTY-17254661 | io.netty:netty-codec-http2 | 4.1.118.Final | Allocation of Resources Without Limits or Throttling | 2026-06-08 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-45536 | SNYK-JAVA-IONETTY-17260879 | io.netty:netty-transport-native-unix-common | 4.1.118.Final | Missing Release of Resource after Effective Lifetime | 2026-06-08 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41715 | SNYK-JAVA-IOPROJECTREACTORNETTY-17260961 | io.projectreactor.netty:reactor-netty-http | 1.0.48 | Cleartext Transmission of Sensitive Information | 2026-06-08 | 9.0.2 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41852 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17253570 | org.springframework:spring-expression | 6.2.8 | Exposed Dangerous Method or Function | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41848 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254051 | org.springframework:spring-core | 6.2.8 | Regular Expression Denial of Service (ReDoS) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41853 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254109 | org.springframework:spring-web | 6.2.8 | HTTP Request Smuggling | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41839 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254128 | org.springframework:spring-web | 6.2.8 | Session Fixation | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-41854 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17254521 | org.springframework:spring-web | 6.2.8 | Server-side Request Forgery (SSRF) | 2026-06-08 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-41845 | SNYK-JAVA-ORGSPRINGFRAMEWORK-17255245 | org.springframework:spring-web | 6.2.8 | Cross-site Scripting (XSS) | 2026-06-08 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44496 | SNYK-JS-AXIOS-17172532 | axios | 1.8.4 | Regular Expression Denial of Service (ReDoS) | 2026-06-04 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-44488 | SNYK-JS-AXIOS-17172751 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44487 | SNYK-JS-AXIOS-17172930 | axios | 1.8.4 | Insertion of Sensitive Information Into Sent Data | 2026-06-04 | vulnerable_code_not_in_execute_path | |
| medium | CVE-2026-44490 | SNYK-JS-AXIOS-17111081 | axios | 1.8.4 | Prototype Pollution | 2026-05-29 | vulnerable_code_cannot_be_controlled_by_adversary | |
| medium | CVE-2026-42580 | SNYK-JAVA-IONETTY-16438926 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42578 | SNYK-JAVA-IONETTY-16438935 | io.netty:netty-handler-proxy | 4.1.118.Final | CRLF Injection | 2026-05-07 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41417 | SNYK-JAVA-IONETTY-16425695 | io.netty:netty-codec-http | 4.1.118.Final | HTTP Request Smuggling | 2026-05-05 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-43869 | SNYK-JAVA-ORGAPACHETHRIFT-16432027 | org.apache.thrift:libthrift | 0.21.0 | Improper Validation of Certificate with Host Mismatch | 2026-05-05 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41603 | SNYK-JAVA-ORGAPACHETHRIFT-16323114 | org.apache.thrift:libthrift | 0.21.0 | Improper Validation of Certificate with Host Mismatch | 2026-04-28 | 9.2.1 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42040 | SNYK-JS-AXIOS-16298055 | axios | 1.8.4 | Improper Encoding or Escaping of Output | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42038 | SNYK-JS-AXIOS-16298095 | axios | 1.8.4 | Server-side Request Forgery (SSRF) | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42034 | SNYK-JS-AXIOS-16298130 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42036 | SNYK-JS-AXIOS-16298162 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2026-04-24 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-42042 | SNYK-JS-AXIOS-16299478 | axios | 1.8.4 | Insertion of Sensitive Information Into Sent Data | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42037 | SNYK-JS-AXIOS-16299819 | axios | 1.8.4 | CRLF Injection | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-42041 | SNYK-JS-AXIOS-16299925 | axios | 1.8.4 | Prototype Pollution | 2026-04-24 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22746 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121176 | org.springframework.security:spring-security-core | 6.5.1 | Information Exposure | 2026-04-22 | 8.5.4 | vulnerable_code_cannot_be_controlled_by_adversary |
| medium | CVE-2026-22748 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448 | org.springframework.security:spring-security-oauth2-jose | 6.5.1 | Insufficient Verification of Data Authenticity | 2026-04-22 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22751 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-16120313 | org.springframework.security:spring-security-core | 6.5.1 | Time-of-check Time-of-use (TOCTOU) Race Condition | 2026-04-21 | 8.5.4 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41238 | SNYK-JS-DOMPURIFY-16132234 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-22745 | SNYK-JAVA-ORGSPRINGFRAMEWORK-16109618 | org.springframework:spring-core | 6.2.8 | Allocation of Resources Without Limits or Throttling | 2026-04-17 | 8.5.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-41240 | SNYK-JS-DOMPURIFY-16078387 | dompurify | 3.2.5 | Operator Precedence Logic Error | 2026-04-16 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-0636 | SNYK-JAVA-ORGBOUNCYCASTLE-16075254 | org.bouncycastle:bcprov-jdk18on | 1.80 | LDAP Injection | 2026-04-15 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-62718 | SNYK-JS-AXIOS-15965856 | axios | 1.8.4 | Unintended Proxy or Intermediary ('Confused Deputy') | 2026-04-09 | 9.2.0 | component_not_present |
| medium | (none) | SNYK-JS-DOMPURIFY-15874903 | dompurify | 3.2.5 | Prototype Pollution | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15874905 | dompurify | 3.2.5 | Permissive List of Allowed Inputs | 2026-04-03 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-DOMPURIFY-15810938 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-03-27 | 9.1.3 | vulnerable_code_not_in_execute_path |
| medium | CVE-2026-33532 | SNYK-JS-YAML-15765520 | yaml | 1.10.2 | Uncontrolled Recursion | 2026-03-25 | 9.2.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-15599 | SNYK-JS-DOMPURIFY-15371386 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-03-03 | 9.1.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-58754 | SNYK-JS-AXIOS-12613773 | axios | 1.8.4 | Allocation of Resources Without Limits or Throttling | 2025-09-10 | 9.0.0 | vulnerable_code_not_in_execute_path |
| medium | CVE-2025-53864 | SNYK-JAVA-COMNIMBUSDS-10691768 | com.nimbusds:nimbus-jose-jwt | 9.37.3 | Uncontrolled Recursion | 2025-07-11 | 8.5.2 | vulnerable_code_not_in_execute_path |
| medium | (none) | SNYK-JS-D3COLOR-1076592 | d3-color | 1.4.1 | Regular Expression Denial of Service (ReDoS) | 2021-02-18 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | (none) | SNYK-JS-DOMPURIFY-17344552 | dompurify | 3.2.5 | Protection Mechanism Failure | 2026-06-15 | vulnerable_code_not_in_execute_path | |
| low | CVE-2026-41239 | SNYK-JS-DOMPURIFY-16131135 | dompurify | 3.2.5 | Cross-site Scripting (XSS) | 2026-04-19 | 9.2.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2025-22227 | SNYK-JAVA-IOPROJECTREACTORNETTY-10770514 | io.projectreactor.netty:reactor-netty-http | 1.0.48 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | 2025-07-15 | 9.0.0 | vulnerable_code_not_in_execute_path |
| low | CVE-2018-25050 | SNYK-JS-CHOSENJS-3184933 | chosen-js | 1.6.2 | Cross-site Scripting (XSS) | 2022-12-29 | 9.2.0 | vulnerable_code_cannot_be_controlled_by_adversary |
| low | CVE-2020-29582 | SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 | org.jetbrains.kotlin:kotlin-stdlib | 1.8.21 | Information Exposure | 2022-02-03 | vulnerable_code_not_in_execute_path |
Previous release was affected, but this one is not.
| Severity | CVE | Snyk ID | Module | Version | Title | Disclosed |
|---|---|---|---|---|---|---|
| high | (none) | SNYK-JAVA-COMGITHUBJUNRAR-16097905 | com.github.junrar:junrar | 7.5.5 | Directory Traversal | 2026-04-16 |
| high | CVE-2026-28208 | SNYK-JAVA-COMGITHUBJUNRAR-15360268 | com.github.junrar:junrar | 7.5.5 | Directory Traversal | 2026-02-27 |
| high | CVE-2025-68470 | SNYK-JS-REMIXRUNROUTER-14908287 | @remix-run/router | 1.14.1 | Open Redirect | 2026-01-08 |
| high | CVE-2026-22029 | SNYK-JS-REMIXRUNROUTER-14908530 | @remix-run/router | 1.14.1 | Cross-site Scripting (XSS) | 2026-01-08 |
| high | CVE-2025-48976 | SNYK-JAVA-ORGAPACHECOMMONS-10363251 | org.apache.commons:commons-fileupload2-core | 2.0.0-M2 | Allocation of Resources Without Limits or Throttling | 2025-06-16 |
| high | CVE-2025-48734 | SNYK-JAVA-COMMONSBEANUTILS-10259368 | commons-beanutils:commons-beanutils | 1.9.4 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | 2025-05-28 |
| medium | CVE-2026-41245 | SNYK-JAVA-COMGITHUBJUNRAR-16115493 | com.github.junrar:junrar | 7.5.5 | Directory Traversal | 2026-04-20 |
| medium | CVE-2025-8916 | SNYK-JAVA-ORGBOUNCYCASTLE-11789695 | org.bouncycastle:bcprov-jdk18on | 1.78.1 | Allocation of Resources Without Limits or Throttling | 2025-08-13 |
| medium | CVE-2025-41234 | SNYK-JAVA-ORGSPRINGFRAMEWORK-10345766 | org.springframework:spring-web | 6.1.18 | HTTP Response Splitting | 2025-06-12 |
| medium | CVE-2025-4949 | SNYK-JAVA-ORGECLIPSEJGIT-10231763 | org.eclipse.jgit:org.eclipse.jgit | 7.2.0.202503040940-r | XML External Entity (XXE) Injection | 2025-05-21 |
| medium | CVE-2025-22234 | SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-9789380 | org.springframework.security:spring-security-crypto | 6.3.8 | Timing Attack | 2025-04-22 |
| low | CVE-2025-22233 | SNYK-JAVA-ORGSPRINGFRAMEWORK-10176071 | org.springframework:spring-context | 6.1.18 | Improper Handling of Case Sensitivity | 2025-05-15 |
| low | CVE-2025-26791 | SNYK-JS-DOMPURIFY-8722251 | dompurify | 2.5.7 | Cross-site Scripting (XSS) | 2025-02-14 |