BomLensSBOM
Security Report

Security Report

Project: SpringBootDemo · Generated: · Engine: Trivy

Critical 8 High 35 Medium 35 Low 14 Unknown 0 KEV 1

EPSS = exploit probability (FIRST.org) · KEV = CISA known-exploited · priority: KEV → severity → EPSS

SeverityKEVCVSSEPSSCVEPackageInstalledFixedTitle
CRITICALKEV100.999CVE-2025-24813org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.3, 10.1.35, 9.0.99tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CRITICAL9.80.017CVE-2026-41293org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.118, 10.1.55, 11.0.22tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
CRITICAL9.80.013CVE-2026-43512org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.118, 10.1.55, 11.0.22tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
CRITICAL9.10.012CVE-2026-43515org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.118, 10.1.55, 11.0.22tomcat-coyote: tomcat: Improper Authorization allows security bypass
CRITICAL9.80.006CVE-2026-47884org.springframework:spring-webmvc6.1.17.0.9org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CRITICAL9.80.005CVE-2026-65905org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.25, 10.1.58, 9.0.121tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CRITICAL9.10.005CVE-2026-65182org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.25, 10.1.58, 9.0.121tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CRITICAL9.10.004CVE-2026-68525org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.25, 10.1.58, 9.0.121tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
HIGH7.50.644CVE-2025-55752org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.11, 10.1.45, 9.0.109tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE
HIGH7.50.56CVE-2024-38819org.springframework:spring-webmvc6.1.16.1.14org.springframework:spring-webmvc: Path traversal vulnerability in functional web frameworks
HIGH9.80.318CVE-2024-50379org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.2, 10.1.34, 9.0.98tomcat: RCE due to TOCTOU issue in JSP compilation
HIGH7.50.304CVE-2025-48988org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.8, 10.1.42, 9.0.106tomcat: Apache Tomcat DoS in multipart upload
HIGH7.50.212CVE-2024-38816org.springframework:spring-webmvc6.1.16.1.13spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource
HIGH9.80.089CVE-2024-56337org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.2, 10.1.34, 9.0.98tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation
HIGH7.50.046CVE-2024-34750org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.0-M21, 10.1.25, 9.0.90tomcat: Improper Handling of Exceptional Conditions
HIGH8.10.039CVE-2024-22243org.springframework:spring-web6.1.16.1.4, 6.0.17, 5.3.32springframework: URL Parsing with Host Validation
HIGH7.50.036CVE-2025-48989org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.10, 10.1.44, 9.0.108tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames
HIGH8.10.025CVE-2024-22259org.springframework:spring-web6.1.16.1.5, 6.0.18, 5.3.33springframework: URL Parsing with Host Validation
HIGH7.50.021CVE-2025-52520org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.9, 10.1.43, 9.0.107tomcat: Apache Tomcat denial of service
HIGH7.50.021CVE-2025-53506org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.107, 10.1.43, 11.0.9tomcat: Apache Tomcat denial of service
HIGH8.60.016CVE-2024-38286org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.0-M21, 10.1.25, 9.0.90tomcat: Denial of Service in Tomcat
HIGH8.10.012CVE-2026-54513com.fasterxml.jackson.core:jackson-databind2.16.02.18.8, 2.21.4, 3.1.4jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
HIGH8.10.011CVE-2024-22262org.springframework:spring-web6.1.15.3.34, 6.0.19, 6.1.6springframework: URL Parsing with Host Validation
HIGH8.10.009CVE-2026-54512com.fasterxml.jackson.core:jackson-databind2.16.02.18.8, 3.1.4, 2.21.4jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
HIGH7.50.009CVE-2023-6378ch.qos.logback:logback-classic1.4.111.3.12, 1.4.12, 1.2.13logback: serialization vulnerability in logback receiver
HIGH7.50.009CVE-2023-6378ch.qos.logback:logback-core1.4.111.3.12, 1.4.12, 1.2.13logback: serialization vulnerability in logback receiver
HIGH7.50.008CVE-2026-41284org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.118, 10.1.55, 11.0.22tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation
HIGH7.50.006CVE-2026-24880org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.116, 10.1.52, 11.0.20Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension
HIGH7.30.006CVE-2026-42498org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.118, 10.1.55, 11.0.22tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authent
HIGH7.50.006CVE-2026-68497com.fasterxml.jackson.core:jackson-databind2.16.02.18.10, 2.21.6, 2.22.2com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Servic
HIGH7.50.005CVE-2026-24734org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.18, 10.1.52, 9.0.115tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation
HIGH7.50.005CVE-2026-89425com.fasterxml.jackson.core:jackson-core2.16.02.21.7, 2.22.3, 2.18.11com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malfo
HIGH7.50.005CVE-2026-43513org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.118, 10.1.55, 11.0.22tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm
HIGH7.50.004CVE-2026-91776com.fasterxml.jackson.core:jackson-databind2.16.02.18.11, 2.21.7, 2.22.3jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in
HIGH7.50.004CVE-2026-91777com.fasterxml.jackson.core:jackson-databind2.16.02.21.7, 2.18.11, 2.22.3com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service vi
HIGH7.50.004CVE-2025-41249org.springframework:spring-core6.1.16.2.11org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability
HIGH7.50.004CVE-2026-68494com.fasterxml.jackson.core:jackson-core2.16.02.18.8, 2.21.4com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete
HIGH7.50.004CVE-2026-34483org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.116, 10.1.54, 11.0.21Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve
HIGH7.50.004CVE-2026-34487org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.117, 10.1.54, 11.0.21Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files
HIGH7.30.004CVE-2025-22235org.springframework.boot:spring-boot3.2.03.3.11, 3.4.5org.springframework.boot/spring-boot: Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not
HIGH7.50.003CVE-2026-41842org.springframework:spring-webmvc6.1.17.0.8, 6.2.19spring-framework: Spring Framework: Denial of Service when resolving static resources
HIGH7.50.003CVE-2026-41850org.springframework:spring-expression6.1.17.0.8, 6.2.19spring-framework: Spring Framework: Denial of Service via specially crafted SpEL expressions
HIGH7.10.001CVE-2026-41845org.springframework:spring-webmvc6.1.17.0.8, 6.2.19org.springframework: Spring Framework: Cross-site scripting (XSS) via incorrect JavaScript escaping
MEDIUM7.50.613CVE-2025-31650org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.104, 10.1.40, 11.0.6tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
MEDIUM7.50.23CVE-2024-24549org.apache.tomcat.embed:tomcat-embed-core10.1.168.5.99, 9.0.86, 10.1.19, 11.0.0-M17Tomcat: HTTP/2 header handling DoS
MEDIUM7.50.034CVE-2025-49125org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.8, 10.1.42, 9.0.106tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources
MEDIUM6.50.026CVE-2025-48924org.apache.commons:commons-lang33.14.03.18.0commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang
MEDIUM7.50.023CVE-2024-23672org.apache.tomcat.embed:tomcat-embed-websocket10.1.1611.0.0-M17, 10.1.19, 9.0.86, 8.5.99Tomcat: WebSocket DoS with incomplete closing handshake
MEDIUM5.90.021CVE-2025-41242org.springframework:spring-webmvc6.1.16.2.10org.springframework/spring-webmvc: Spring Framework MVC path traversal vulnerability
MEDIUM6.50.008CVE-2025-55668org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.8, 10.1.42, 9.0.106org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve
MEDIUM5.30.008CVE-2024-38809org.springframework:spring-web6.1.15.3.38, 6.0.23, 6.1.12org.springframework:spring-web: Spring Framework DoS via conditional HTTP request
MEDIUM5.60.007CVE-2026-83557com.fasterxml.jackson.core:jackson-databind2.16.02.18.10, 2.21.6, 2.22.2com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via i
MEDIUM5.30.006CVE-2024-38820org.springframework:spring-context6.1.16.1.14The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...
MEDIUM5.30.006CVE-2024-38820org.springframework:spring-web6.1.16.1.14The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...
MEDIUM6.50.006CVE-2025-41234org.springframework:spring-web6.1.16.2.8, 6.1.21springframework: Reflected download attack in Spring Framework with non-ASCII headers
MEDIUM5.90.005CVE-2026-49844org.apache.logging.log4j:log4j-api2.21.12.25.5, 2.26.1org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point v
MEDIUM5.30.005CVE-2026-19032com.fasterxml.jackson.core:jackson-databind2.16.02.18.10, 2.21.6, 2.22.2com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI sch
MEDIUM6.10.005CVE-2026-25854org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.116, 10.1.53, 11.0.20Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve
MEDIUM5.50.004CVE-2024-12798ch.qos.logback:logback-core1.4.111.5.13, 1.3.15logback-core: arbitrary code execution via JaninoEventEvaluator
MEDIUM5.30.004CVE-2026-54515com.fasterxml.jackson.core:jackson-databind2.16.03.1.4, 2.18.9, 2.21.5, 2.22.1jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified
MEDIUM6.50.004CVE-2026-59888com.fasterxml.jackson.core:jackson-databind2.16.02.18.8, 2.21.4com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass i
MEDIUM5.30.004CVE-2026-18401com.fasterxml.jackson.core:jackson-core2.16.02.21.1, 2.18.6tools.jackson.core/jackson-core: com.fasterxml.jackson.core/jackson-core: jackson-core: Denial of Service due to number
MEDIUM6.50.004CVE-2026-22737org.springframework:spring-webmvc6.1.17.0.6, 6.2.17Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views
MEDIUM7.50.003CVE-2026-41851org.springframework:spring-expression6.1.17.0.8, 6.2.19Spring Framework: Spring Framework: Denial of Service via unbounded cache growth in SpEL evaluation
MEDIUM5.90.003CVE-2026-41843org.springframework:spring-webmvc6.1.17.0.8, 6.2.19spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal
MEDIUM5.30.003CVE-2026-54514com.fasterxml.jackson.core:jackson-databind2.16.02.18.8, 2.21.4, 3.1.4jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution
MEDIUM8.40.003CVE-2025-49124org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.8, 10.1.42, 9.0.106Apache Tomcat installer for Windows has an untrusted search path vulnerability
MEDIUM6.50.003CVE-2026-59889com.fasterxml.jackson.core:jackson-databind2.16.02.21.5, 2.18.9, 2.22.1com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrap
MEDIUM5.30.003CVE-2026-22745org.springframework:spring-webmvc6.1.17.0.7, 6.2.18spring-webflux: Spring MVC and Spring WebFlux: Denial of Service via slow static resource resolution on Windows
MEDIUM5.90.003CVE-2026-41841org.springframework:spring-webmvc6.1.17.0.8, 6.2.19Spring Framework: Spring MVC and WebFlux applications: Information Disclosure via static resource resolution
MEDIUM5.90.003CVE-2026-41721org.springframework.data:spring-data-commons3.2.04.0.6, 3.5.12Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload
MEDIUM5.30.003CVE-2026-77310com.fasterxml.jackson.core:jackson-databind2.16.02.18.9, 2.21.5, 2.22.1com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration
MEDIUM5.90.003CVE-2026-41711org.springframework.data:spring-data-commons3.2.04.0.6, 3.5.12Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters
MEDIUM9.10.002CVE-2025-66614org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.15, 10.1.50, 9.0.113tomcat: Client certificate verification bypass due to virtual host mapping
MEDIUM6.40.001CVE-2025-11226ch.qos.logback:logback-core1.4.111.5.19, 1.3.16ch.qos.logback/logback-core: Conditional abitrary code execution in logback-core
MEDIUM5.30.001CVE-2026-41853org.springframework:spring-webmvc6.1.17.0.8, 6.2.19Spring Framework: Spring Framework: Request smuggling vulnerability in Spring MVC and WebFlux
MEDIUM6.80.001CVE-2026-41846org.springframework:spring-webmvc6.1.17.0.8, 6.2.19Spring Framework: Spring Framework: Cross-site scripting (XSS) via user-supplied values in JSP form tags
MEDIUM6.10.001CVE-2026-41844org.springframework:spring-webmvc6.1.17.0.8, 6.2.19Spring Framework: Spring Framework: Open Redirect via crafted link
LOW9.70.101CVE-2025-55754org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.11, 10.1.45, 9.0.109org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation
LOW9.80.041CVE-2025-31651org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.104, 10.1.40, 11.0.6tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve
LOW7.30.031CVE-2025-46701org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.105, 10.1.41, 11.0.7tomcat: Apache Tomcat: Security constraint bypass for CGI scripts
LOW5.30.012CVE-2025-61795org.apache.tomcat.embed:tomcat-embed-core10.1.1611.0.12, 10.1.47, 9.0.110tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service
LOW3.10.004CVE-2025-22233org.springframework:spring-context6.1.16.2.7, 6.1.20CVE-2024-38820 ensured Locale-independent, lowercase conversion for bo ...
LOW0.003CVE-2026-10532ch.qos.logback:logback-core1.4.111.5.34Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...
LOW0.003CVE-2026-9828ch.qos.logback:logback-core1.4.111.5.33Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...
LOW3.70.003CVE-2026-43514org.apache.tomcat.embed:tomcat-embed-core10.1.169.0.118, 10.1.55, 11.0.22tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy
LOW7.50.003CVE-2026-41848org.springframework:spring-core6.1.17.0.8, 6.2.19spring-framework: Spring Framework: Regular Expression Denial of Service in AntPathMatcher
LOW5.90.002CVE-2026-22741org.springframework:spring-webmvc6.1.17.0.7, 6.2.18Spring MVC: Spring WebFlux: Spring MVC and Spring WebFlux: Denial of Service via cache poisoning
LOW3.30.002CVE-2024-12801ch.qos.logback:logback-core1.4.111.5.13, 1.3.15logback-core: SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks
LOW5.30.001CVE-2026-41852org.springframework:spring-expression6.1.17.0.8, 6.2.19spring-framework: org.springframework/spring-expression: Spring Framework: SpEL vulnerability allows unintended applicat
LOW50.001CVE-2026-1225ch.qos.logback:logback-core1.4.111.5.25ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes
LOW2.60.001CVE-2026-22735org.springframework:spring-webmvc6.1.17.0.6, 6.2.17org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnera