Press CTR-C to copy XML [help]


Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

Project: waffle-demo-spring-boot-filter4

com.github.waffle.demo.jakarta:waffle-demo-spring-boot-filter4:3.6.1-SNAPSHOT

Scan Information (show all):

Summary

Summary of Vulnerable Dependencies (click to show all)

Dependency Vulnerability IDs Package Highest Severity CVE Count Confidence Evidence Count
caffeine-3.2.4.jar pkg:maven/com.github.ben-manes.caffeine/caffeine@3.2.4   0 33
checker-qual-4.2.3.jar pkg:maven/org.checkerframework/checker-qual@4.2.3   0 44
com.github.waffle:waffle-jna-jakarta:3.6.1-SNAPSHOT pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT   0 6
com.github.waffle:waffle-spring-boot-autoconfigure4:3.6.1-SNAPSHOT pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure4@3.6.1-SNAPSHOT   0 6
com.github.waffle:waffle-spring-boot-starter4:3.6.1-SNAPSHOT pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT   0 6
com.github.waffle:waffle-spring-security7:3.6.1-SNAPSHOT pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT   0 6
commons-logging-1.3.6.jar pkg:maven/commons-logging/commons-logging@1.3.6   0 129
error_prone_annotations-2.50.0.jar pkg:maven/com.google.errorprone/error_prone_annotations@2.50.0   0 29
j2objc-annotations-3.1.jar pkg:maven/com.google.j2objc/j2objc-annotations@3.1   0 33
jackson-annotations-2.21.jar cpe:2.3:a:fasterxml:jackson-core:2.21:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-modules-java8:2.21:*:*:*:*:*:*:* 		pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.21   0 Highest 36
jackson-core-3.1.5.jar cpe:2.3:a:fasterxml:jackson-core:3.1.5:*:*:*:*:*:*:* pkg:maven/tools.jackson.core/jackson-core@3.1.5   0 Highest 50
jackson-databind-3.1.5.jar cpe:2.3:a:fasterxml:jackson-core:3.1.5:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-databind:3.1.5:*:*:*:*:*:*:* 		pkg:maven/tools.jackson.core/jackson-databind@3.1.5   0 Highest 37
jakarta.annotation-api-3.0.0.jar pkg:maven/jakarta.annotation/jakarta.annotation-api@3.0.0   0 42
jakarta.servlet-api-6.1.0.jar pkg:maven/jakarta.servlet/jakarta.servlet-api@6.1.0   0 44
jna-5.19.1.jar pkg:maven/net.java.dev.jna/jna@5.19.1   0 48
jna-5.19.1.jar: jnidispatch.dll   0 2
jna-5.19.1.jar: jnidispatch.dll   0 2
jna-5.19.1.jar: jnidispatch.dll   0 2
jna-platform-5.19.1.jar pkg:maven/net.java.dev.jna/jna-platform@5.19.1   0 42
jspecify-1.0.1.jar cpe:2.3:a:google:gmail:1.0.1:*:*:*:*:*:*:* pkg:maven/org.jspecify/jspecify@1.0.1   0 Low 44
jsr305-3.0.2.jar pkg:maven/com.google.code.findbugs/jsr305@3.0.2   0 17
jul-to-slf4j-2.0.18.jar pkg:maven/org.slf4j/jul-to-slf4j@2.0.18   0 31
log4j-api-2.26.1.jar cpe:2.3:a:apache:log4j:2.26.1:*:*:*:*:*:*:* pkg:maven/org.apache.logging.log4j/log4j-api@2.26.1   0 Highest 43
logback-classic-1.6.3.jar cpe:2.3:a:qos:logback:1.6.3:*:*:*:*:*:*:* pkg:maven/ch.qos.logback/logback-classic@1.6.3   0 Highest 38
logback-core-1.5.38.jar cpe:2.3:a:qos:logback:1.5.38:*:*:*:*:*:*:* pkg:maven/ch.qos.logback/logback-core@1.5.38   0 Highest 38
micrometer-commons-1.17.1.jar pkg:maven/io.micrometer/micrometer-commons@1.17.1   0 69
micrometer-observation-1.17.1.jar pkg:maven/io.micrometer/micrometer-observation@1.17.1   0 69
slf4j-api-2.0.18.jar pkg:maven/org.slf4j/slf4j-api@2.0.18   0 29
snakeyaml-2.6.jar cpe:2.3:a:snakeyaml_project:snakeyaml:2.6:*:*:*:*:*:*:* pkg:maven/org.yaml/snakeyaml@2.6   0 Highest 42
spotbugs-annotations-4.10.4.jar pkg:maven/com.github.spotbugs/spotbugs-annotations@4.10.4   0 53
spring-boot-web-server-4.1.1.jar cpe:2.3:a:vmware:spring_boot:4.1.1:*:*:*:*:*:*:* pkg:maven/org.springframework.boot/spring-boot-web-server@4.1.1   0 Highest 42
spring-core-7.0.9.jar cpe:2.3:a:pivotal_software:spring_framework:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:springsource:spring_framework:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_framework:7.0.9:*:*:*:*:*:*:* 		pkg:maven/org.springframework/spring-core@7.0.9   0 Highest 41
spring-security-core-7.1.1.jar cpe:2.3:a:pivotal_software:spring_security:7.1.1:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_security:7.1.1:*:*:*:*:*:*:* 		pkg:maven/org.springframework.security/spring-security-core@7.1.1   0 Highest 38
spring-security-web-7.1.1.jar: spring-security-webauthn.js   0 0
tomcat-embed-core-11.0.24.jar cpe:2.3:a:apache:tomcat:11.0.24:*:*:*:*:*:*:*
cpe:2.3:a:apache_tomcat:apache_tomcat:11.0.24:*:*:*:*:*:*:* 		pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@11.0.24 CRITICAL 11 Highest 63
tomcat-embed-el-11.0.24.jar pkg:maven/org.apache.tomcat.embed/tomcat-embed-el@11.0.24   0 33

Dependencies (vulnerable)

caffeine-3.2.4.jar

Description:

A high performance caching library

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/github/ben-manes/caffeine/caffeine/3.2.4/caffeine-3.2.4.jar
MD5: 04d655feb58be297a86fa2814a1f1ef8
SHA1: c63b303adf59c733d2a96125ad6670e938a2c15d
SHA256:9d9d2cfd681fd9272ded3d27c9930db12f89f732345975aa113ebc223bbf1224
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
caffeine-3.2.4.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.github.ben-manes.caffeine/caffeine@3.2.4   (Confidence:High)

checker-qual-4.2.3.jar

Description:

checker-qual contains annotations (type qualifiers) that a programmerwrites to specify Java code for type-checking by the Checker Framework.

License:

The MIT License: https://opensource.org/licenses/MIT
File Path: /home/runner/.m2/repository/org/checkerframework/checker-qual/4.2.3/checker-qual-4.2.3.jar
MD5: d9e63a451931be32bd29cfc3ac5674c1
SHA1: d2a10af5c8574adfe24f5e35ff56cca92af2e916
SHA256:f868f731f6e37db3e1c2140d06016477989959a2d13fc5bed9c46760cffd5ba0
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
checker-qual-4.2.3.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/org.checkerframework/checker-qual@4.2.3   (Confidence:High)

com.github.waffle:waffle-jna-jakarta:3.6.1-SNAPSHOT

Description:

WAFFLE JNA Jakarta Pakage implementation

License:

MIT https://opensource.org/licenses/MIT
File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-jna-jakarta/pom.xml

Referenced In Project/Scope: waffle-demo-spring-boot-filter4
com.github.waffle:waffle-jna-jakarta:3.6.1-SNAPSHOT is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT   (Confidence:Highest)

com.github.waffle:waffle-spring-boot-autoconfigure4:3.6.1-SNAPSHOT

Description:

Spring Boot 4 Autoconfigure for WAFFLE

License:

MIT https://opensource.org/licenses/MIT
File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-spring-boot4/waffle-spring-boot-autoconfigure4/pom.xml

Referenced In Project/Scope: waffle-demo-spring-boot-filter4
com.github.waffle:waffle-spring-boot-autoconfigure4:3.6.1-SNAPSHOT is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure4@3.6.1-SNAPSHOT   (Confidence:Highest)

com.github.waffle:waffle-spring-boot-starter4:3.6.1-SNAPSHOT

Description:

Spring Boot 4 Starter for WAFFLE

License:

MIT https://opensource.org/licenses/MIT
File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-spring-boot4/waffle-spring-boot-starter4/pom.xml

Referenced In Project/Scope: waffle-demo-spring-boot-filter4
com.github.waffle:waffle-spring-boot-starter4:3.6.1-SNAPSHOT is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT   (Confidence:Highest)

com.github.waffle:waffle-spring-security7:3.6.1-SNAPSHOT

Description:

Spring Security 7 integration for WAFFLE

License:

MIT https://opensource.org/licenses/MIT
File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-spring-security7/pom.xml

Referenced In Project/Scope: waffle-demo-spring-boot-filter4
com.github.waffle:waffle-spring-security7:3.6.1-SNAPSHOT is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.github.waffle/waffle-spring-security7@3.6.1-SNAPSHOT   (Confidence:Highest)

commons-logging-1.3.6.jar

Description:

Apache Commons Logging is a thin adapter allowing configurable bridging to other,
    well-known logging systems.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-logging/commons-logging/1.3.6/commons-logging-1.3.6.jar
MD5: fe0ccbe8971fed954a0ad6528fe3ef24
SHA1: 63e78ca6cd446c0ad166d14f03ed99e7efb3896d
SHA256:f8ead8943401081dea0aa824b5b1ba40a0e4ed297a572a0f02258150a0b62357
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
commons-logging-1.3.6.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/commons-logging/commons-logging@1.3.6   (Confidence:High)

error_prone_annotations-2.50.0.jar

Description:

Error Prone is a static analysis tool for Java that catches common programming mistakes at compile-time.

License:

Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/errorprone/error_prone_annotations/2.50.0/error_prone_annotations-2.50.0.jar
MD5: 1ded1848cfd4f5167e00824faf9c4d3b
SHA1: 74ba43e49ab1184d41634af2ef0047e82c4064b0
SHA256:4667724877f1d37a689202da191e23efa7657c62eef93ccdac406eccfe5cdd0a
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:provided
error_prone_annotations-2.50.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.google.errorprone/error_prone_annotations@2.50.0   (Confidence:High)

j2objc-annotations-3.1.jar

Description:

    A set of annotations that provide additional information to the J2ObjC
    translator to modify the result of translation.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/j2objc/j2objc-annotations/3.1/j2objc-annotations-3.1.jar
MD5: abe8bd3abff622b9a8b15c3a737aa741
SHA1: a892ca9507839bbdb900d64310ac98256cab992f
SHA256:84d3a150518485f8140ea99b8a985656749629f6433c92b80c75b36aba3b099b
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:provided
j2objc-annotations-3.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.google.j2objc/j2objc-annotations@3.1   (Confidence:High)

jackson-annotations-2.21.jar

Description:

Core annotations used for value types, used by Jackson data binding package.

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-annotations/2.21/jackson-annotations-2.21.jar
MD5: e0d0c3e7300954f73e43c67d933aaea4
SHA1: b1bc1868bf02dc0bd6c7836257a036a331005309
SHA256:53ca085f4a150f703f49e1aabd935bd03b43e1ea3d55d135438292af22cef56b
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
jackson-annotations-2.21.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@4.1.1

Identifiers

  • pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.21   (Confidence:High)
  • cpe:2.3:a:fasterxml:jackson-core:2.21:*:*:*:*:*:*:*   (Confidence:Highest)   
  • cpe:2.3:a:fasterxml:jackson-modules-java8:2.21:*:*:*:*:*:*:*   (Confidence:Low)   

jackson-core-3.1.5.jar

Description:

Core Jackson processing abstractions (aka Streaming API), implementation for JSON

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/tools/jackson/core/jackson-core/3.1.5/jackson-core-3.1.5.jar
MD5: ed1c26680ceec80183239a74ef15a838
SHA1: ccd7eb3269b8d33bc097b36770f367cdfe2f1150
SHA256:9431b7fa2673bbb618c11d865fe15e13222fd182a214ff998cb7e56afd8f35d2
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
jackson-core-3.1.5.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@4.1.1

Identifiers

jackson-databind-3.1.5.jar

Description:

General data-binding functionality for Jackson: works on core streaming API

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/tools/jackson/core/jackson-databind/3.1.5/jackson-databind-3.1.5.jar
MD5: 7b399cbb2bea1429c46c1b8c73af42b9
SHA1: 782178f0b1fe088803c03b85eb9a406f60519044
SHA256:3a2338d996fd3056791df8d335fa9ba8a62a706ed4245ecf81b3e583df37d08a
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
jackson-databind-3.1.5.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@4.1.1

Identifiers

jakarta.annotation-api-3.0.0.jar

Description:

Jakarta Annotations API

License:

EPL 2.0: https://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html
File Path: /home/runner/.m2/repository/jakarta/annotation/jakarta.annotation-api/3.0.0/jakarta.annotation-api-3.0.0.jar
MD5: 7faffaab962918da4cf5ddfd76609dd2
SHA1: 54f928fadec906a99d558536756d171917b9d936
SHA256:b01f55552284cfb149411e64eabca75e942d26d2e1786b32914250e4330afaa2
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
jakarta.annotation-api-3.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter@4.1.1

Identifiers

  • pkg:maven/jakarta.annotation/jakarta.annotation-api@3.0.0   (Confidence:High)

jakarta.servlet-api-6.1.0.jar

Description:

Jakarta Servlet 6.1

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html
File Path: /home/runner/.m2/repository/jakarta/servlet/jakarta.servlet-api/6.1.0/jakarta.servlet-api-6.1.0.jar
MD5: 314c930b3e40ac1abc3529c7c9942f09
SHA1: 1169a246913fe3823782af7943e7a103634867c5
SHA256:8a31f465f3593bf2351531a5c952014eb839da96a605b5825b93dd54714c48c4
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:provided
jakarta.servlet-api-6.1.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/jakarta.servlet/jakarta.servlet-api@6.1.0   (Confidence:High)

jna-5.19.1.jar

Description:

Java Native Access

License:

LGPL-2.1-or-later: https://www.gnu.org/licenses/old-licenses/lgpl-2.1
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar
MD5: cf327da3e9cf5a5d77c8a43540320929
SHA1: ca303052cd617c1af2e2c8d344c98a706fb63143
SHA256:4fb141dd8ef6b0585ffceea4bc49602fbc6312fa977e2c488794ea3e6aafecae
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
jna-5.19.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/net.java.dev.jna/jna@5.19.1   (Confidence:High)

jna-5.19.1.jar: jnidispatch.dll

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar/com/sun/jna/win32-aarch64/jnidispatch.dll
MD5: 302945a811fd8e21bcdd5226c73b6f74
SHA1: 6b05e299ff2b3eb3b7b7aeac44263f715693607c
SHA256:b8f98be314234cf12b5b46c29652f70c0f6abb93ae19b63d3fe2692062aa699d
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile

Identifiers

  • None

jna-5.19.1.jar: jnidispatch.dll

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar/com/sun/jna/win32-x86-64/jnidispatch.dll
MD5: 2d2475f1f026dd54e9f3e787ae4f81da
SHA1: 27ff882ac271db547aee520b38e3ba9aa91e136c
SHA256:5a7ff949f6d93d86491eb5b26b1cfc60051168a60622650224b89995ac420023
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile

Identifiers

  • None

jna-5.19.1.jar: jnidispatch.dll

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar/com/sun/jna/win32-x86/jnidispatch.dll
MD5: 0caa1ef75a807f9dde05084fa2219a5c
SHA1: 2f5e1cd82cde192905c7510ce99037b67d980640
SHA256:752d597cee7e95cb517327146bf42f124c0d6c0bc48b3ecc3b1b3b0531a52f44
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile

Identifiers

  • None

jna-platform-5.19.1.jar

Description:

Java Native Access Platform

License:

LGPL-2.1-or-later: https://www.gnu.org/licenses/old-licenses/lgpl-2.1
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/net/java/dev/jna/jna-platform/5.19.1/jna-platform-5.19.1.jar
MD5: 1d97b6103a9b3b7ddb671908683f4566
SHA1: d1e54d9231da5ca3fa730d52960deaa555475468
SHA256:3b3864f5b449e9c3c24b16861524b622b086563f44e0cd8384c8efc5a6052f82
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
jna-platform-5.19.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/net.java.dev.jna/jna-platform@5.19.1   (Confidence:High)

jspecify-1.0.1.jar

Description:

An artifact of well-named and well-specified annotations to power static analysis checks

License:

The Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/jspecify/jspecify/1.0.1/jspecify-1.0.1.jar
MD5: d4fe1ea4d953b66fcb1d6043c22bffcf
SHA1: 3d60fd98eb8ade73004f4195c37b6317e02cf3d7
SHA256:070d75f261fe4c5b8202508366715f7f2d4660f88c8ef7e6d3575e48c9683b66
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
jspecify-1.0.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.junit.jupiter/junit-jupiter-engine@6.0.3

Identifiers

  • pkg:maven/org.jspecify/jspecify@1.0.1   (Confidence:High)
  • cpe:2.3:a:google:gmail:1.0.1:*:*:*:*:*:*:*   (Confidence:Low)   

jsr305-3.0.2.jar

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar
MD5: dd83accb899363c32b07d7a1b2e4ce40
SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d
SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:provided
jsr305-3.0.2.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.spotbugs/spotbugs-annotations@4.10.4

Identifiers

  • pkg:maven/com.google.code.findbugs/jsr305@3.0.2   (Confidence:High)

jul-to-slf4j-2.0.18.jar

Description:

JUL to SLF4J bridge

License:

https://opensource.org/license/mit
File Path: /home/runner/.m2/repository/org/slf4j/jul-to-slf4j/2.0.18/jul-to-slf4j-2.0.18.jar
MD5: f339bf7648049b2105e180cab6c45c9d
SHA1: 79739c98001d5c9d078d087d5a348ec9e474ec8f
SHA256:cbb7d1aaaa9e871eb1a06594abd911bf97027152976edf1edc315be75239204e
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
jul-to-slf4j-2.0.18.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter@4.1.1

Identifiers

  • pkg:maven/org.slf4j/jul-to-slf4j@2.0.18   (Confidence:High)

log4j-api-2.26.1.jar

Description:

The logging API of the Log4j project.
    Library and application code can log through this API.
    It contains a simple built-in implementation (`SimpleLogger`) for trivial use cases.
    Production applications are recommended to use Log4j API in combination with a fully-fledged implementation, such as Log4j Core.

License:

Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/apache/logging/log4j/log4j-api/2.26.1/log4j-api-2.26.1.jar
MD5: 8ed35fc9ea449bc9e21a8139842d6233
SHA1: b9864ed8d0c01f65f3b0bf70f1447e5cc1b49c24
SHA256:f1810a4704ccce019d02bba029dc02a4f2ac0c997f647b465e7d409c1927f822
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
log4j-api-2.26.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter@4.1.1

Identifiers

logback-classic-1.6.3.jar

Description:

logback-classic module

License:

https://www.eclipse.org/legal/epl-v20.html, https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html
File Path: /home/runner/.m2/repository/ch/qos/logback/logback-classic/1.6.3/logback-classic-1.6.3.jar
MD5: c4c3210a25faea352ecfe9ea2c219c14
SHA1: a8fc332633a9da2e543afb20357b7a015437f0a9
SHA256:beebede8db065fe1b72909ecc66bb49acda618901635d86c25fce14a5915e37e
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
logback-classic-1.6.3.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT

Identifiers

logback-core-1.5.38.jar

Description:

logback-core module

License:

https://www.eclipse.org/legal/epl-v20.html, https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html
File Path: /home/runner/.m2/repository/ch/qos/logback/logback-core/1.5.38/logback-core-1.5.38.jar
MD5: a065b3893602a19f6f393a42c499c198
SHA1: 7b1d133b29bf42ff268cf3f71d1308b80480fb8d
SHA256:a855a0fc97b1d06f4efb1c3bba5ebd0eb508d8b58e68e89e4bbc23a85135c883
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
logback-core-1.5.38.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/ch.qos.logback/logback-classic@1.6.3

Identifiers

micrometer-commons-1.17.1.jar

Description:

Module containing common code

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/io/micrometer/micrometer-commons/1.17.1/micrometer-commons-1.17.1.jar
MD5: aa9291ad211473834d3d48453ae05ea1
SHA1: b1c3fdea68c5a81495cf1c16cf2905c5ad9f30d2
SHA256:f2cee6ef046e72eec8128474c7f58c6217173b45ae373c30de0289f2a56ab0fd
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
micrometer-commons-1.17.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/io.micrometer/micrometer-commons@1.17.1   (Confidence:High)

micrometer-observation-1.17.1.jar

Description:

Module containing Observation related code

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/io/micrometer/micrometer-observation/1.17.1/micrometer-observation-1.17.1.jar
MD5: f63baf5840fb4446b9313a3bd8773da1
SHA1: 24c0b05bc06a9ab6f4e09a48949b6eccc179ca15
SHA256:eb34f0cd84a879393ae5c21160fc06385ccdc74f36a4d1e31b199f59acfdaf71
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
micrometer-observation-1.17.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/io.micrometer/micrometer-observation@1.17.1   (Confidence:High)

slf4j-api-2.0.18.jar

Description:

The slf4j API

License:

https://opensource.org/license/mit
File Path: /home/runner/.m2/repository/org/slf4j/slf4j-api/2.0.18/slf4j-api-2.0.18.jar
MD5: fe2837bd49bfb76657419002fed20ca9
SHA1: 78a9e7a37cd6360e0b818e86341b24123d28d4df
SHA256:44508fd1576500688c790b190acdd16fec4f8c79a3e0b900afd70503cf055f55
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
slf4j-api-2.0.18.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/org.slf4j/slf4j-api@2.0.18   (Confidence:High)

snakeyaml-2.6.jar

Description:

YAML 1.1 parser and emitter for Java

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/yaml/snakeyaml/2.6/snakeyaml-2.6.jar
MD5: d8bd94536cee962cfff39730bffdb8da
SHA1: 2bc14918a2f8d5414749ab12d0c590cd3198b8c1
SHA256:c8f7a98e7394adda02f6317249710e4d1b4c7a25aa8c7eace0c2eea52eb8bf85
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
snakeyaml-2.6.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter@4.1.1

Identifiers

spotbugs-annotations-4.10.4.jar

Description:

Annotations the SpotBugs tool supports

License:

GNU LESSER GENERAL PUBLIC LICENSE, Version 2.1: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html
File Path: /home/runner/.m2/repository/com/github/spotbugs/spotbugs-annotations/4.10.4/spotbugs-annotations-4.10.4.jar
MD5: 472925cb4e5451c8f7a1aeeefe286622
SHA1: 7eb4c58212378becfb6ea6d236ec24a2352a316e
SHA256:28fa4befaddce5d7b79b07c68e7c12fa27c5d9282c4229528717971606661ea3
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:provided
spotbugs-annotations-4.10.4.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-boot-filter4@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.github.spotbugs/spotbugs-annotations@4.10.4   (Confidence:High)

spring-boot-web-server-4.1.1.jar

Description:

Spring Boot Web Server

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot-web-server/4.1.1/spring-boot-web-server-4.1.1.jar
MD5: a060efd710429298574e5f7615e4f6df
SHA1: d1eb8e523013ac3939ae59adc5335a3de704d11b
SHA256:6912fb1fdf7f657a61ac050760fa835fb1e7496399291697e2901f82887a4fee
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
spring-boot-web-server-4.1.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@4.1.1

Identifiers

spring-core-7.0.9.jar

Description:

Spring Core

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /home/runner/.m2/repository/org/springframework/spring-core/7.0.9/spring-core-7.0.9.jar
MD5: f87ba857b1fb00b125568d966aa66058
SHA1: e03c619fc5b26931973277f5ba65ae47967a20e3
SHA256:5195f4722699b39878d99a832549fe65df2890b159d063b88fff31b1ca65ae36
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
spring-core-7.0.9.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT

Identifiers

spring-security-core-7.1.1.jar

Description:

Spring Security

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-core/7.1.1/spring-security-core-7.1.1.jar
MD5: e9c072aeb1ab83fb92dd5a0bc556a857
SHA1: c0373b564151af7a3001ccfbea589bf37dd6dc3b
SHA256:98a5011baa78df36fb184e6ce0e8e086ca9a64fcdd8f161c0a96475a3a0907bd
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
spring-security-core-7.1.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-boot-starter4@3.6.1-SNAPSHOT

Identifiers

spring-security-web-7.1.1.jar: spring-security-webauthn.js

File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-web/7.1.1/spring-security-web-7.1.1.jar/org/springframework/security/spring-security-webauthn.js
MD5: d8d90d854a23d021c2e758b3eebce213
SHA1: 7814ccd3adc2388f52b2658bf5fc30b457949ab6
SHA256:044a2b8d7e995bff815565678631a2d3a5cc0aa96ef8ac35cfacb579307f77a9
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile

Identifiers

  • None

tomcat-embed-core-11.0.24.jar

Description:

Core Tomcat implementation

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/11.0.24/tomcat-embed-core-11.0.24.jar
MD5: 87410cbfa90c782419859efb70e1fd91
SHA1: 0172bb449cba1a8ffcffa249727907602a4cc899
SHA256:e7b966dcaac8c5ffa4f10e44031ebf5b71f2123560c08ac8b7120028615aea08
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
tomcat-embed-core-11.0.24.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@4.1.1

Identifiers

CVE-2026-65637  

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.



This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-65905  

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST 
authenticated request with a nonceCount on the upper boundary of the 
replay window then that request is replayable once only while the 
associated nonceCount remains within the replay window.



 

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
CWE-294 Authentication Bypass by Capture-replay

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-65182  

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.



Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
CWE-863 Incorrect Authorization, CWE-284 Improper Access Control

CVSSv3:
  • Base Score: CRITICAL (9.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-68525  

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.







This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.







The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.















Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.
CWE-863 Incorrect Authorization

CVSSv3:
  • Base Score: CRITICAL (9.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-65183  

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120.



Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv3:
  • Base Score: HIGH (8.1)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-66422  

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
CWE-285 Improper Authorization

CVSSv3:
  • Base Score: HIGH (8.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-68569  

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.







The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.







Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
CWE-287 Improper Authentication

CVSSv3:
  • Base Score: HIGH (8.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-65927  

Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.







This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.
CWE-193 Off-by-one Error

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-68763  

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
CWE-400 Uncontrolled Resource Consumption

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-73180  

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
CWE-613 Insufficient Session Expiration

CVSSv3:
  • Base Score: MEDIUM (6.8)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-66299  

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.

This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.

Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.
CWE-400 Uncontrolled Resource Consumption

CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

tomcat-embed-el-11.0.24.jar

Description:

Core Tomcat implementation

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-el/11.0.24/tomcat-embed-el-11.0.24.jar
MD5: cb6b040782afb670264116a994b0bcae
SHA1: 3eafa072a45e67081452e56576ab4fe68b525fb5
SHA256:ad0546f12dace008aacce18ba13222137760b310ca719e173d3e13021b9af6c6
Referenced In Project/Scope: waffle-demo-spring-boot-filter4:compile
tomcat-embed-el-11.0.24.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@4.1.1

Identifiers

  • pkg:maven/org.apache.tomcat.embed/tomcat-embed-el@11.0.24   (Confidence:High)


This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog.
This report may contain data retrieved from the Github Advisory Database (via NPM Audit API).
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype Guide OSS Index API.