gitsafehub
github.com/fuzhengwei/xfg-dev-tech-micro-service-b ↗

fuzhengwei/xfg-dev-tech-micro-service-b

scanned 2026-08-13 · git bd6eeda
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies26Known OSS vulnerabilities98Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 26 found · 1 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2016-1000027 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
    pom.xml
    A package you depend on has a known security hole (CVE-2016-1000027). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-40984 micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests
    pom.xml
    A package you depend on has a known security hole (CVE-2026-40984). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-48924 commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang
    pom.xml
    A package you depend on has a known security hole (CVE-2025-48924). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-22235 org.springframework.boot/spring-boot: Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed
    pom.xml
    A package you depend on has a known security hole (CVE-2025-22235). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-40973 Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory
    pom.xml
    A package you depend on has a known security hole (CVE-2026-40973). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-22733 Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints
    pom.xml
    A package you depend on has a known security hole (CVE-2026-22733). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-22243 springframework: URL Parsing with Host Validation
    pom.xml
    A package you depend on has a known security hole (CVE-2024-22243). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-22259 springframework: URL Parsing with Host Validation
    pom.xml
    A package you depend on has a known security hole (CVE-2024-22259). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-22262 springframework: URL Parsing with Host Validation
    pom.xml
    A package you depend on has a known security hole (CVE-2024-22262). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-38809 org.springframework:spring-web: Spring Framework DoS via conditional HTTP request
    pom.xml
    A package you depend on has a known security hole (CVE-2024-38809). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-38820 The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...
    pom.xml
    A package you depend on has a known security hole (CVE-2024-38820). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-38816 spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource
    pom.xml
    A package you depend on has a known security hole (CVE-2024-38816). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-38819 org.springframework:spring-webmvc: Path traversal vulnerability in functional web frameworks
    pom.xml
    A package you depend on has a known security hole (CVE-2024-38819). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41842 spring-framework: Spring Framework: Denial of Service when resolving static resources
    pom.xml
    A package you depend on has a known security hole (CVE-2026-41842). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41845 org.springframework: Spring Framework: Cross-site scripting (XSS) via incorrect JavaScript escaping
    pom.xml
    A package you depend on has a known security hole (CVE-2026-41845). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-38828 org.springframework:spring-webmvc: DoS via Spring MVC controller method with byte[] parameter
    pom.xml
    A package you depend on has a known security hole (CVE-2024-38828). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-41242 org.springframework/spring-webmvc: Spring Framework MVC path traversal vulnerability
    pom.xml
    A package you depend on has a known security hole (CVE-2025-41242). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-22737 Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views
    pom.xml
    A package you depend on has a known security hole (CVE-2026-22737). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-22745 spring-webflux: Spring MVC and Spring WebFlux: Denial of Service via slow static resource resolution on Windows
    pom.xml
    A package you depend on has a known security hole (CVE-2026-22745). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41841 Spring MVC and WebFlux applications are vulnerable to Information Disc ...
    pom.xml
    A package you depend on has a known security hole (CVE-2026-41841). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41843 spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal
    pom.xml
    A package you depend on has a known security hole (CVE-2026-41843). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41844 Spring Framework: Spring Framework: Open Redirect via crafted link
    pom.xml
    A package you depend on has a known security hole (CVE-2026-41844). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41846 Spring Framework: Spring Framework: Cross-site scripting (XSS) via user-supplied values in JSP form tags
    pom.xml
    A package you depend on has a known security hole (CVE-2026-41846). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41853 Spring Framework: Spring Framework: Request smuggling vulnerability in Spring MVC and WebFlux
    pom.xml
    A package you depend on has a known security hole (CVE-2026-41853). Fix: Update that package to its patched version.
  • Minor CVE-2026-22735 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events
    pom.xml
    A package you depend on has a known security hole (CVE-2026-22735). Fix: Update that package to its patched version.
… 1 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 98 found · 8 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GHSA-5j33-cvvr-w245 Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2024-50379). Fix: Update that package to its patched version.
  • Serious GHSA-5m62-pw8w-7w9f Apache Tomcat - Security constraints not correctly applied
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2026-43515). Fix: Update that package to its patched version.
  • Serious GHSA-83qj-6fr2-vhqg Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2025-24813). Fix: Update that package to its patched version.
  • Serious GHSA-fpj8-gq4v-p354 Apache Tomcat - Client certificate verification bypass
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2025-66614). Fix: Update that package to its patched version.
  • Serious GHSA-h6fc-48rj-7qqh Apache Tomcat - Digest authenticator will authenticate any unknown user
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2026-43512). Fix: Update that package to its patched version.
  • Serious GHSA-r29c-68gh-xp6x Apache Tomcat - HTTP/2 request headers not validated
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2026-41293). Fix: Update that package to its patched version.
  • Serious GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2025-55754). Fix: Update that package to its patched version.
  • Serious GHSA-4wrc-f8pq-fpqp Pivotal Spring Framework contains unsafe Java deserialization methods
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2016-1000027). Fix: Update that package to its patched version.
  • Worth fixing GHSA-j288-q9x7-2f5v Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2025-48924). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mgvc-8q2h-5pgc Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2026-22733). Fix: Update that package to its patched version.
  • Worth fixing GHSA-vmq6-5m68-f53m logback serialization vulnerability
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2023-6378). Fix: Update that package to its patched version.
  • Worth fixing GHSA-25qh-j22f-pwp8 QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2025-11226). Fix: Update that package to its patched version.
  • Worth fixing GHSA-gm62-rw4g-vrc4 Logback is vulnerable to an attacker mounting a Denial-Of-Service attack by sending poisoned data
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2023-6481). Fix: Update that package to its patched version.
  • Worth fixing GHSA-pr98-23f8-jwxv QOS.CH logback-core Expression Language Injection vulnerability
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2024-12798). Fix: Update that package to its patched version.
  • Worth fixing GHSA-vmq6-5m68-f53m logback serialization vulnerability
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2023-6378). Fix: Update that package to its patched version.
  • Worth fixing GHSA-h46c-h94j-95f3 jackson-core can throw a StackoverflowError when processing deeply nested data
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2025-52999). Fix: Update that package to its patched version.
  • Worth fixing GHSA-r7wm-3cxj-wff9 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-3wrr-7qpf-2prh jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2026-50193). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5jmj-h7xm-6q6v jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2026-54515). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hgj6-7826-r7m5 jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2026-54514). Fix: Update that package to its patched version.
  • Worth fixing GHSA-j3rv-43j4-c7qm jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2026-54512). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rmj7-2vxq-3g9f jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2026-54513). Fix: Update that package to its patched version.
  • Worth fixing GHSA-pfh2-hfmq-phg5 json-path Out-of-bounds Write vulnerability
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2023-51074). Fix: Update that package to its patched version.
  • Worth fixing GHSA-g3pr-3p32-fp23 Micrometer HTTP server instrumentations DoS
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2026-40984). Fix: Update that package to its patched version.
  • Worth fixing GHSA-23hv-mwm6-g8jf Apache Tomcat Session Fixation vulnerability
    /workdirs/scan-57fd2fc3-9f29-435a-a8bd-acd14e3a22e3/pom.xml
    A package you depend on has a known security hole (CVE-2025-55668). Fix: Update that package to its patched version.
… 73 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.