Vulnerability Directory
If you’re currently using these frameworks in your application’s tech stack, your application could be vulnerable.
Secure drop-in replacements for open source software from HeroDevs helps you stay secure, compliant, and compatible while you migrate.
Switch to Never-Ending Support (NES) from HeroDevs to immediately mitigate these vulnerabilities.
Severity
ID
Technology
Libraries Affected
Category
Version(s) Affected
Published Date
Medium
Apache Log4j
Apache Log4j 2
Information Exposure
>=2.0-beta9 <=2.25.2, >=3.0.0-alpha1 <=3.0.0-beta3
May 5, 2026
Medium
Apache Log4j
Apache Log4j 2
Information Exposure
>=2.12.0 <=2.25.3, >=3.0.0-alpha1 <=3.0.0-beta3
May 5, 2026
Medium
Apache Log4j
Apache Log4j 2
Denial of Service
>=2.7 <=2.25.3, >=3.0.0-beta1 <=3.0.0-beta2
May 5, 2026
Medium
Apache Log4j
Apache Log4j 2
Denial of Service
>=2.0-alpha1 <=2.25.3, >=3.0.0-alpha1 <=3.0.0-beta3
May 5, 2026
Medium
Apache Log4j
Apache Log4j 2
Denial of Service
>=2.14.0 <=2.25.3, >=3.0.0-alpha1 <=3.0.0-beta3
May 5, 2026
Medium
Spring
Spring Boot
Denial of Service
>=2.5.0 <=2.7.17, >=3.0.0 <=3.0.12, >=3.1.0 <=3.1.5
May 1, 2026
Medium
Spring
Spring AMQP
Remote Code Execution
>=1.0.0 <=2.4.16, >=3.0.0 <=3.0.9
May 1, 2026
Medium
Ingress NGINX
github.com/gomarkdown/markdown; reaches Ingress NGINX Controller via the bundled gomarkdown dependency
Denial of Service
<v0.0.0-20240729232818-a2a9c4f76ef5 (and Ingress NGINX builds that ship an earlier gomarkdown)
Apr 29, 2026
High
Ingress NGINX
github.com/gomarkdown/markdown; reaches Ingress NGINX Controller via the bundled gomarkdown dependency
Denial of Service
<v0.0.0-20260411013819-759bbc3e3207 (and Ingress NGINX builds that ship an earlier gomarkdown)
Apr 29, 2026
Medium
Ingress NGINX
Go (golang) standard library, os.Root API; reaches Ingress NGINX Controller via the Go toolchain it is built with
Improper Link Resolution Before File Access ('Link Following')
Go <1.25.9 and 1.26.0 through 1.26.1 (and Ingress NGINX builds compiled with them)
Apr 29, 2026
High
Ingress NGINX
Helm (Kubernetes package manager), helm.sh/helm/v4; reaches Ingress NGINX Controller via the bundled Helm dependency
Improper Verification of Cryptographic Signature
Helm 4.0.0 through 4.1.3 (and Ingress NGINX builds that ship them)
Apr 29, 2026
High
Ingress NGINX
Helm (Kubernetes package manager), helm.sh/helm/v4; reaches Ingress NGINX Controller via the bundled Helm dependency
Path Traversal
Helm 4.0.0 through 4.1.3 (and Ingress NGINX builds that ship them)
Apr 29, 2026
Medium
Spring
Spring Boot
Path Traversal
>=1.0.2 <=2.7.32, >=3.3.0 <=3.3.18, >=3.4.0 <=3.4.15, >=3.5.0 <=3.5.13, >=4.0.0 <=4.0.5
Apr 27, 2026
Medium
Spring
Spring Boot
Information Exposure
>=1.0.0 <=3.5.13, >=4.0.0 <=4.0.5
Apr 27, 2026
No results found
Please enter a valid Vulnerability ID number or Technology name.