Update Mend: high confidence minor and patch dependency updates - #2
Open
mend-for-github-com[bot] wants to merge 1 commit into
Mend for GitHub.com / Mend Security Check
failed
Sep 4, 2026 in 10m 15s
Security Report
❗️Scan Warnings: The scan completed with warnings. The integration encountered issues with one or more projects in this repository. Consequently, there may be gaps in the coverage of open-source dependencies used in the repository.
Scan Details Report
maven
/tmp/ws-scm/WebGoat3/pom.xml
| Step | Level | Description | Details |
|---|---|---|---|
| Preparing the project for scan | ⚠Warn | One or more of the installations failed | [ERROR] [ERROR] Some problems were encountered while processing the POMs: [FATAL] Non-resolvable parent POM for org.owasp.webgoat:webgoat:2023.4: The following artifacts could not be resolved: org.springframework.boot:spring-boot-starter-parent:pom:2.7.18 (absent): Could not transfer artifact org.springframework.boot:spring-boot-starter-parent:pom:2.7.18 from/to central (https://repo.maven.apac... |
| Resolving the project | ⚠Warn | Some problems occurred while performing the resolution operation |
|
You have successfully remediated 211 vulnerabilities, but introduced 4 new vulnerabilities in this branch.❌ New vulnerabilities:
| Vulnerability | Severity |  CVSS Score |
Exploit Maturity | EPSS | Vulnerable Library | Direct Library | Suggested Fix | Issue | Reachability |
|---|---|---|---|---|---|---|---|---|---|
CVE-2025-4641Path to dependency file: /pom.xml Path to vulnerable library: /pom.xml Dependency Hierarchy: -> ❌ webdrivermanager-4.4.3.jar (Vulnerable Library) |
 Critical |
10.0 | Not Defined | 0.555% | Direct webdrivermanager-4.4.3.jar |
webdrivermanager-4.4.3.jar | 6.1.0 | None | |
CVE-2023-2976Path to dependency file: /pom.xml Path to vulnerable library: /pom.xml Dependency Hierarchy: -> ❌ guava-30.1.1-jre.jar (Vulnerable Library) |
 Medium |
5.5 | Not Defined | 0.248% | Direct guava-30.1.1-jre.jar |
guava-30.1.1-jre.jar | 32.0.1-android | None | |
CVE-2023-41329Path to dependency file: /pom.xml Path to vulnerable library: /pom.xml Dependency Hierarchy: -> ❌ wiremock-2.27.2.jar (Vulnerable Library) |
 Low |
3.9 | Not Defined | 0.571% | Direct wiremock-2.27.2.jar |
wiremock-2.27.2.jar | 3.0.0-beta-1 | #64 | |
CVE-2020-8908Path to dependency file: /pom.xml Path to vulnerable library: /pom.xml Dependency Hierarchy: -> ❌ guava-30.1.1-jre.jar (Vulnerable Library) |
Low |
3.3 | Not Defined | 0.964% | Direct guava-30.1.1-jre.jar |
guava-30.1.1-jre.jar | 32.0.0-android | None |
✔️ Remediated vulnerabilities:
| Vulnerability | Vulnerable Library |
|---|---|
| CVE-2022-31692 | spring-security-core-5.7.2.jar |
| CVE-2026-54512 | jackson-databind-2.13.3.jar |
| CVE-2026-40973 | spring-boot-2.7.1.jar |
| CVE-2024-38809 | spring-web-5.3.21.jar |
| CVE-2022-25857 | snakeyaml-1.30.jar |
| CVE-2026-59314 | spring-web-5.3.21.jar |
| CVE-2023-3223 | undertow-servlet-2.2.18.Final.jar |
| CVE-2026-40975 | spring-boot-2.7.1.jar |
| CVE-2026-41853 | spring-webmvc-5.3.21.jar |
| CVE-2026-59281 | spring-web-5.3.21.jar |
| CVE-2024-38820 | spring-context-5.3.21.jar |
| CVE-2026-41841 | spring-webmvc-5.3.21.jar |
| CVE-2026-47891 | spring-web-5.3.21.jar |
| CVE-2025-9784 | undertow-core-2.2.18.Final.jar |
| CVE-2023-4639 | undertow-core-2.2.18.Final.jar |
| CVE-2026-41706 | spring-security-web-5.7.2.jar |
| CVE-2024-38828 | spring-webmvc-5.3.21.jar |
| CVE-2024-38816 | spring-webmvc-5.3.21.jar |
| CVE-2026-22745 | spring-webmvc-5.3.21.jar |
| CVE-2026-41844 | spring-webmvc-5.3.21.jar |
| CVE-2022-38752 | snakeyaml-1.30.jar |
| CVE-2023-20862 | spring-security-core-5.7.2.jar |
| CVE-2026-41846 | spring-webmvc-5.3.21.jar |
| CVE-2024-38827 | spring-security-core-5.7.2.jar |
| CVE-2026-77310 | jackson-databind-2.13.3.jar |
| CVE-2025-41242 | spring-webmvc-5.3.21.jar |
| CVE-2024-22262 | spring-web-5.3.21.jar |
| CVE-2023-38286 | thymeleaf-3.0.15.RELEASE.jar |
| CVE-2026-41001 | spring-boot-autoconfigure-2.7.1.jar |
| CVE-2026-22735 | spring-webmvc-5.3.21.jar |
| CVE-2024-38819 | spring-webmvc-5.3.21.jar |
| CVE-2024-29371 | jose4j-0.7.6.jar |
| CVE-2024-22259 | spring-web-5.3.21.jar |
| CVE-2026-40992 | spring-boot-autoconfigure-2.7.1.jar |
| CVE-2026-59313 | spring-webmvc-5.3.21.jar |
| CVE-2026-40478 | thymeleaf-3.0.15.RELEASE.jar |
| WS-2022-0468 | jackson-core-2.13.3.jar |
| CVE-2026-5680 | undertow-core-2.2.18.Final.jar |
| CVE-2026-41716 | spring-data-commons-2.7.1.jar |
| CVE-2022-41853 | hsqldb-2.5.2.jar |
| CVE-2022-1259 | undertow-core-2.2.18.Final.jar |
| CVE-2026-40977 | spring-boot-2.7.1.jar |
| CVE-2026-19879 | undertow-core-2.2.18.Final.jar |
| CVE-2022-38749 | snakeyaml-1.30.jar |
| CVE-2022-38751 | snakeyaml-1.30.jar |
| CVE-2024-38828 | spring-core-5.3.21.jar |
| CVE-2026-41848 | spring-core-5.3.21.jar |
| CVE-2013-7285 | xstream-1.4.5.jar |
| CVE-2026-71497 | jsoup-1.14.3.jar |
| CVE-2024-1635 | undertow-core-2.2.18.Final.jar |
| CVE-2021-39152 | xstream-1.4.5.jar |
| CVE-2024-3653 | undertow-servlet-2.2.18.Final.jar |
| CVE-2024-38808 | spring-expression-5.3.21.jar |
| CVE-2026-41721 | spring-data-commons-2.7.1.jar |
| CVE-2026-81624 | undertow-servlet-2.2.18.Final.jar |
| CVE-2026-19880 | logback-classic-1.2.11.jar |
| CVE-2021-39139 | xstream-1.4.5.jar |
| CVE-2024-38821 | spring-security-web-5.7.2.jar |
| CVE-2025-46295 | commons-text-1.9.jar |
| CVE-2026-22740 | spring-web-5.3.21.jar |
| CVE-2021-39149 | xstream-1.4.5.jar |
| CVE-2024-38827 | spring-security-crypto-5.7.2.jar |
| CVE-2026-0603 | hibernate-core-5.6.9.Final.jar |
| CVE-2022-4492 | undertow-core-2.2.18.Final.jar |
| CVE-2026-41843 | spring-webmvc-5.3.21.jar |
| CVE-2026-81624 | undertow-websockets-jsr-2.2.18.Final.jar |
| CVE-2023-20862 | spring-security-web-5.7.2.jar |
| MSC-2022-1557 | event-source-polyfill-1.0.26.tgz |
| CVE-2020-8908 | guava-30.1-jre.jar |
| CVE-2025-48924 | commons-lang3-3.12.0.jar |
| CVE-2025-22235 | spring-boot-actuator-autoconfigure-2.7.1.jar |
| CVE-2026-40478 | thymeleaf-spring5-3.0.15.RELEASE.jar |
| CVE-2023-51775 | jose4j-0.7.6.jar |
| CVE-2020-26259 | xstream-1.4.5.jar |
| CVE-2021-29425 | commons-io-2.6.jar |
| CVE-2026-59276 | spring-security-core-5.7.2.jar |
| CVE-2026-47884 | spring-webmvc-5.3.21.jar |
| CVE-2026-41845 | spring-web-5.3.21.jar |
| CVE-2026-59295 | micrometer-core-1.9.1.jar |
| CVE-2023-20883 | spring-boot-autoconfigure-2.7.1.jar |
| CVE-2021-21351 | xstream-1.4.5.jar |
| CVE-2026-47838 | spring-security-web-5.7.2.jar |
| CVE-2021-21341 | xstream-1.4.5.jar |
| CVE-2026-81624 | undertow-core-2.2.18.Final.jar |
| CVE-2026-15561 | undertow-core-2.2.18.Final.jar |
| CVE-2024-38827 | spring-security-config-5.7.2.jar |
| CVE-2023-20861 | spring-expression-5.3.21.jar |
| CVE-2024-6162 | undertow-core-2.2.18.Final.jar |
| CVE-2026-59296 | micrometer-core-1.9.1.jar |
| CVE-2026-41901 | thymeleaf-spring5-3.0.15.RELEASE.jar |
| CVE-2024-38820 | spring-web-5.3.21.jar |
| CVE-2021-21348 | xstream-1.4.5.jar |
| CVE-2026-49844 | log4j-api-2.17.2.jar |
| CVE-2026-40477 | thymeleaf-spring5-3.0.15.RELEASE.jar |
| CVE-2021-21346 | xstream-1.4.5.jar |
| CVE-2026-40974 | spring-boot-autoconfigure-2.7.1.jar |
| CVE-2026-1225 | logback-core-1.2.11.jar |
| CVE-2026-41845 | spring-webmvc-5.3.21.jar |
| CVE-2025-22228 | spring-security-crypto-5.7.2.jar |
| CVE-2026-41711 | spring-data-commons-2.7.1.jar |
| CVE-2026-22746 | spring-security-core-5.7.2.jar |
| CVE-2016-1000027 | spring-web-5.3.21.jar |
| CVE-2026-41853 | spring-web-5.3.21.jar |
| CVE-2021-39145 | xstream-1.4.5.jar |
| CVE-2022-42889 | commons-text-1.9.jar |
| CVE-2022-41966 | xstream-1.4.5.jar |
| CVE-2021-39144 | xstream-1.4.5.jar |
| CVE-2026-22735 | spring-web-5.3.21.jar |
| CVE-2026-59282 | spring-beans-5.3.21.jar |
| CVE-2024-7885 | undertow-core-2.2.18.Final.jar |
| CVE-2026-41840 | spring-web-5.3.21.jar |
| CVE-2026-41849 | spring-expression-5.3.21.jar |
| CVE-2021-21344 | xstream-1.4.5.jar |
| CVE-2024-5971 | undertow-core-2.2.18.Final.jar |
| CVE-2026-22732 | spring-security-web-5.7.2.jar |
| CVE-2026-19032 | jackson-databind-2.13.3.jar |
| CVE-2021-21345 | xstream-1.4.5.jar |
| CVE-2025-41242 | spring-beans-5.3.21.jar |
| CVE-2025-41249 | spring-core-5.3.21.jar |
| CVE-2025-12543 | undertow-core-2.2.18.Final.jar |
| CVE-2022-2053 | undertow-core-2.2.18.Final.jar |
| CVE-2026-41842 | spring-webmvc-5.3.21.jar |
| CVE-2025-22233 | spring-context-5.3.21.jar |
| CVE-2023-1973 | undertow-core-2.2.18.Final.jar |
| CVE-2026-22733 | spring-boot-actuator-autoconfigure-2.7.1.jar |
| CVE-2022-41854 | snakeyaml-1.30.jar |
| CVE-2022-38750 | snakeyaml-1.30.jar |
| CVE-2021-21350 | xstream-1.4.5.jar |
| CVE-2021-39148 | xstream-1.4.5.jar |
| CVE-2024-12798 | logback-core-1.2.11.jar |
| CVE-2023-34055 | spring-boot-actuator-2.7.1.jar |
| CVE-2020-26258 | xstream-1.4.5.jar |
| CVE-2023-20863 | spring-expression-5.3.21.jar |
| CVE-2026-15554 | undertow-core-2.2.18.Final.jar |
| CVE-2024-38828 | spring-web-5.3.21.jar |
| CVE-2026-54513 | jackson-databind-2.13.3.jar |
| CVE-2021-21349 | xstream-1.4.5.jar |
| CVE-2017-7957 | xstream-1.4.5.jar |
| CVE-2023-6378 | logback-core-1.2.11.jar |
| CVE-2021-39151 | xstream-1.4.5.jar |
| CVE-2021-39141 | xstream-1.4.5.jar |
| CVE-2021-21347 | xstream-1.4.5.jar |
| WS-2023-0116 | jose4j-0.7.6.jar |
| CVE-2023-20860 | spring-webmvc-5.3.21.jar |
| CVE-2026-22737 | spring-webmvc-5.3.21.jar |
| CVE-2026-22733 | spring-boot-starter-actuator-2.7.1.jar |
| CVE-2024-22257 | spring-security-core-5.7.2.jar |
| CVE-2025-52999 | jackson-core-2.13.3.jar |
| CVE-2026-41901 | thymeleaf-3.0.15.RELEASE.jar |
| CVE-2026-40984 | micrometer-core-1.9.1.jar |
| CVE-2024-12798 | logback-classic-1.2.11.jar |
| CVE-2026-13006 | logback-core-1.2.11.jar |
| CVE-2021-39146 | xstream-1.4.5.jar |
| CVE-2021-21342 | xstream-1.4.5.jar |
| CVE-2023-5685 | xnio-api-3.8.7.Final.jar |
| CVE-2024-47072 | xstream-1.4.5.jar |
| CVE-2024-4027 | undertow-core-2.2.18.Final.jar |
| CVE-2023-2976 | guava-30.1-jre.jar |
| CVE-2026-10532 | logback-core-1.2.11.jar |
| CVE-2026-47842 | spring-security-crypto-5.7.2.jar |
| CVE-2026-9828 | logback-core-1.2.11.jar |
| CVE-2022-31692 | spring-security-web-5.7.2.jar |
| CVE-2024-38827 | spring-security-web-5.7.2.jar |
| CVE-2026-82596 | LatencyUtils-2.0.3.jar |
| CVE-2021-39153 | xstream-1.4.5.jar |
| CVE-2026-41852 | spring-expression-5.3.21.jar |
| CVE-2022-42004 | jackson-databind-2.13.3.jar |
| CVE-2026-41839 | spring-web-5.3.21.jar |
| CVE-2026-47887 | spring-webmvc-5.3.21.jar |
| CVE-2016-3674 | xstream-1.4.5.jar |
| CVE-2026-15565 | undertow-websockets-jsr-2.2.18.Final.jar |
| CVE-2024-12801 | logback-core-1.2.11.jar |
| CVE-2022-1471 | snakeyaml-1.30.jar |
| CVE-2023-20873 | spring-boot-actuator-autoconfigure-2.7.1.jar |
| CVE-2023-31582 | jose4j-0.7.6.jar |
| CVE-2026-47838 | spring-security-config-5.7.2.jar |
| CVE-2022-0084 | xnio-api-3.8.7.Final.jar |
| CVE-2026-54514 | jackson-databind-2.13.3.jar |
| CVE-2024-3653 | undertow-core-2.2.18.Final.jar |
| CVE-2026-40477 | thymeleaf-3.0.15.RELEASE.jar |
| CVE-2021-39154 | xstream-1.4.5.jar |
| CVE-2023-34034 | spring-security-config-5.7.2.jar |
| CVE-2026-41850 | spring-expression-5.3.21.jar |
| CVE-2026-50193 | jackson-databind-2.13.3.jar |
| CVE-2024-1459 | undertow-core-2.2.18.Final.jar |
| CVE-2022-40151 | xstream-1.4.5.jar |
| CVE-2022-36033 | jsoup-1.14.3.jar |
| CVE-2026-83557 | jackson-databind-2.13.3.jar |
| CVE-2026-59283 | spring-expression-5.3.21.jar |
| CVE-2024-3884 | undertow-core-2.2.18.Final.jar |
| CVE-2024-38820 | spring-core-5.3.21.jar |
| CVE-2025-22235 | spring-boot-2.7.1.jar |
| CVE-2021-21343 | xstream-1.4.5.jar |
| CVE-2023-5379 | undertow-core-2.2.18.Final.jar |
| CVE-2024-47554 | commons-io-2.6.jar |
| CVE-2021-39150 | xstream-1.4.5.jar |
| CVE-2026-22741 | spring-webmvc-5.3.21.jar |
| CVE-2023-1108 | undertow-core-2.2.18.Final.jar |
| CVE-2025-11226 | logback-core-1.2.11.jar |
| CVE-2022-42003 | jackson-databind-2.13.3.jar |
| CVE-2021-43859 | xstream-1.4.5.jar |
| CVE-2026-47886 | spring-expression-5.3.21.jar |
| CVE-2024-22243 | spring-web-5.3.21.jar |
| CVE-2021-29505 | xstream-1.4.5.jar |
| CVE-2023-6378 | logback-classic-1.2.11.jar |
| CVE-2026-54515 | jackson-databind-2.13.3.jar |
| CVE-2021-39140 | xstream-1.4.5.jar |
| CVE-2021-39147 | xstream-1.4.5.jar |
| CVE-2020-26217 | xstream-1.4.5.jar |
| CVE-2026-41851 | spring-expression-5.3.21.jar |
| CVE-2024-38820 | spring-webmvc-5.3.21.jar |
Base branch total remaining vulnerabilities: 225
Base branch commit: 84634158a9d243ffa915ab9f1ec76bbf0c13774e
Total libraries scanned: 27
Scan token: 75ef253c1b554626a01923d959a747a4
Loading