By clicking "Accept", you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for more information.

PreferencesRejectAccept
Manage Consent Preferences by Category
Essentials
Always active

Necessary for the site to function. Always On.

Used for targeted advertising.

Remembers your preferences and provides enhanced features.

Measures usage and improves your experience.

Reject AllAccept All
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Pink arrow right
Back to all posts
Greg Allen
Greg Allen
Chief Technology Officer
. . .
Security
Mar 12, 2026
CVE-2025-66614 & CVE-2026-24733: Two Tomcat Vulnerabilities That Also Affect Spring Boot 2.7
Apache Tomcat's request handling trusted protocol-level identity signals that attackers can forge — and if you're on Tomcat 8.5 or Spring Boot 2.7, no official patch is coming.
Greg Allen
Greg Allen
Security
Mar 12, 2026
CVE-2025-52999: Denial of Service via Stack Overflow in Jackson Core
Deeply nested JSON can crash your application — and if you're on Spring Boot 2.7, the upgrade path is more complicated than it looks.
Greg Allen
Greg Allen
Thought Leadership
Mar 11, 2026
CRA Reporting Obligations Start September 2026: What EOL Dependencies Mean for Your Compliance
The EU Cyber Resilience Act creates new legal exposure for products containing end-of-life open-source software — and the 24-hour reporting deadline is six months away.
Greg Allen
Greg Allen
Security
Mar 11, 2026
CVE-2026-2818 & CVE-2026-2817: Path Traversal and Insecure Temp Files in Spring Data Geode
Two newly disclosed vulnerabilities target the snapshot import feature in end-of-life Spring Data Geode — here's what they mean for your stack and how to remediate.
Greg Allen
Greg Allen
Security
Mar 5, 2026
CVE-2026-27739: SSRF and Header Injection in Angular SSR Request Handling Pipeline
How Angular's URL reconstruction logic turned trusted headers into an attacker-controlled proxy
Greg Allen
Greg Allen
Security
Mar 5, 2026
CVE-2026-27970: Cross-Site Scripting (XSS) in Angular i18n ICU Messages
How compromised translation files can execute arbitrary JavaScript in Angular applications using internationalization
Greg Allen
Greg Allen
Security
Feb 23, 2026
How to Fix jQuery UI Vulnerabilities: Resolving CVEs in Outdated Versions
Patch CVE-2021-41182, CVE-2021-41183, CVE-2021-41184, and CVE-2010-5312 Without Breaking Your Application
Greg Allen
Greg Allen
Products
Feb 20, 2026
Angular 19 End of Life Is Coming: What Developers Need to Know
What developers need to know about Angular 19 EOL, active CVEs, Angular 20 breaking changes, and your options before May 19, 2026.
Greg Allen
Greg Allen
Security
Feb 18, 2026
How to Patch jQuery Vulnerabilities in Production Without a Full Rewrite
A practical guide to remediating jQuery CVEs in legacy production systems—without breaking your application or delaying compliance.
Greg Allen
Greg Allen
Products
Mar 26, 2025
The Security Risks of Staying on Spring Boot 2.7 and Spring Framework 5
Spring Boot 2.7 and Spring Framework 5 are end-of-life—leaving applications exposed to unpatched vulnerabilities. Here’s what that means for your security and compliance posture.
Greg Allen
Greg Allen
Products
Mar 5, 2025
The State of AngularJS in 2025
The Future of AngularJS: Security Risks, Compatibility Challenges, and How to Stay Protected in 2025
Greg Allen
Greg Allen
Products
Feb 18, 2025
The Security Risks of Staying on Spring Boot 1.5 and Spring Framework 4
Understanding the Security Risks of End-of-Life Spring Boot 1.5 and Spring Framework 4
Greg Allen
Greg Allen
Security
Jul 3, 2024
Why HeroDevs Is Not Affected by the Polyfill.io Supply Chain Attack
Understanding HeroDevs' Immunity to the Polyfill.io Supply Chain Attack
Greg Allen
Greg Allen