github.com/iluwatar/java-design-patterns
Submitted 8/4/2026, 10:25:54 AM · Status: ok
Risk grade
F
100 / 100
Findings
237
0 critical45 high152 medium40 low0 info0 on CISA KEV0ATT&CK
Showing 237 of 237 findings
Findings
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Hibernate vulnerable to SQL InjectiongrypeCVE-2026-0603EPSS 0.8%
- In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserializationgrypeCVE-2026-41731EPSS 0.5%
- jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiationgrypeCVE-2026-54512EPSS 0.8%
- jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)grypeCVE-2026-54513EPSS 0.7%
- Spring Boot accepts predictable temp directory without ownership verificationgrypeCVE-2026-40973EPSS 0.1%
- Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpointsgrypeCVE-2026-22733EPSS 0.4%
- Spring Boot has an Authentication Bypass under Actuator Health groups pathsgrypeCVE-2026-22731EPSS 0.3%
- jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypassjackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization.…trivyCVE-2026-54512
- jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypassjackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization.…trivyCVE-2026-54512
- jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypassjackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization.…trivyCVE-2026-54512
- jackson-databind: Jackson-databind: Security bypass allows arbitrary code executionjackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), …trivyCVE-2026-54513
- jackson-databind: Jackson-databind: Security bypass allows arbitrary code executionjackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), …trivyCVE-2026-54513
- jackson-databind: Jackson-databind: Security bypass allows arbitrary code executionjackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), …trivyCVE-2026-54513
- org.hibernate/hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injectionA flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sen…trivyCVE-2026-0603
- org.hibernate/hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injectionA flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sen…trivyCVE-2026-0603
- Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpointsSpring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 th…trivyCVE-2026-22733
- Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpointsSpring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 th…trivyCVE-2026-22733
- Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpointsSpring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 th…trivyCVE-2026-22733
- Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpointsSpring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 th…trivyCVE-2026-22733
- Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpointsSpring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 th…trivyCVE-2026-22733
- Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpointsSpring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 th…trivyCVE-2026-22733
- Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directoryA local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session …trivyCVE-2026-40973
- Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directoryA local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session …trivyCVE-2026-40973
- Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directoryA local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session …trivyCVE-2026-40973
- Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directoryA local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session …trivyCVE-2026-40973
- Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional pathSpring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot:…trivyCVE-2026-22731
- Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional pathSpring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot:…trivyCVE-2026-22731
- Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional pathSpring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot:…trivyCVE-2026-22731
- Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional pathSpring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot:…trivyCVE-2026-22731
- Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional pathSpring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot:…trivyCVE-2026-22731
- Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional pathSpring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot:…trivyCVE-2026-22731
- spring-kafka: Spring for Apache Kafka: Arbitrary code execution via insecure deserialization of crafted header valuesJsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer coul…trivyCVE-2026-41731
- spring-kafka: Spring for Apache Kafka: Arbitrary code execution via insecure deserialization of crafted header valuesJsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer coul…trivyCVE-2026-41731
- spring-kafka: Spring for Apache Kafka: Arbitrary code execution via insecure deserialization of crafted header valuesJsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer coul…trivyCVE-2026-41731
- spring-kafka: Spring for Apache Kafka: Arbitrary code execution via insecure deserialization of crafted header valuesJsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer coul…trivyCVE-2026-41731
This report is public.