chore: add SBOM notes for highcharts 9.2.2 (CP: 24.4) by totally-not-ai[bot] · Pull Request #9770 · vaadin/platform

totally-not-ai · 2026-10-30T10:14:41Z

Review risk: two-way door — only changes the SBOM check's CVE notes for the 24.4 branch; no product code.

Summary

Ports the SBOM notes from #9742 to 24.4. Vaadin 24.4 ships Highcharts 9.2.2 (not 12.2.0), so the Highcharts note is adapted rather than cherry-picked.

What changed

highcharts 9.2.2: scanners flag it for CVE-2026-118250 (dotted series.keys prototype pollution) and CVE-2026-118251 (javascript: URL in credits.href). Both are fixed in Vaadin Charts by fix: skip unsupported values in chart options (CP: 24.4) web-components#12919 without bumping the bundled Highcharts (announced as CVE-2026-107588). The other three CVEs from the same Highcharts disclosure do not affect 9.2.2 and are not reported for it.
The opentelemetry-api, picomatch and lerc notes from chore: add SBOM notes for opentelemetry-api, picomatch and lerc #9742 are left out: the coordinates they cover are not in this branch's SBOM report.

Test summary

Script parses with Node; CVE lists match the scanner output for this branch exactly (the check requires an exact match).
SBOM workflow on this PR will confirm.

Working on behalf of @ZheSun88

Port of the notes from #9742 to 24.4. Highcharts 9.2.2 is only flagged for CVE-2026-118250 and CVE-2026-118251, both fixed in Vaadin Charts by vaadin/web-components#12919 without bumping the bundled version (announced as CVE-2026-107588).

github-actions · 2026-10-30T10:27:12Z

Dependencies Report

🟠 Known Vulnerabilities:
- Vulnerabilities in: pkg:maven/com.vaadin/vaadin-server@24.4-SNAPSHOT [CVE-2025-15022] (osv-scan)
  👌 False positive: the scanners do not compare SNAPSHOT versions, the fixes are included in the 24.4 branch.
  ·
- Vulnerabilities in: pkg:maven/com.vaadin/vaadin@24.4-SNAPSHOT [CVE-2025-15022, CVE-2026-2742] (osv-scan)
  👌 False positive: the scanners do not compare SNAPSHOT versions, the fixes are included in the 24.4 branch.
  ·
- Vulnerabilities in: pkg:maven/com.vaadin/vaadin-spreadsheet-flow@24.4-SNAPSHOT [CVE-2025-15022] (osv-scan)
  👌 False positive: the scanners do not compare SNAPSHOT versions, the fixes are included in the 24.4 branch.
  ·
- Vulnerabilities in: pkg:maven/com.vaadin/vaadin-upload-flow@24.4-SNAPSHOT [] ()
  👌 False positive: the scanners do not compare SNAPSHOT versions, the fixes are included in the 24.4 branch.
  ·
- Vulnerabilities in: pkg:maven/com.vaadin/flow-server@24.4-SNAPSHOT [CVE-2026-2742] (osv-scan)
  👌 False positive: the scanners do not compare SNAPSHOT versions, the fixes are included in the 24.4 branch.
  ·
- Vulnerabilities in: pkg:maven/org.codehaus.plexus/plexus-utils@3.4.2 [CVE-2025-67030] (osv-scan,owasp)
  👌 This is coming from the build tools (maven plugin), not shipped at runtime, FP for us.
  · cpe:2.3:a:codehaus-plexus:plexus-utils::::::::
- Vulnerabilities in: pkg:maven/org.cyclonedx/cyclonedx-core-java@9.0.4 [CVE-2025-64518] (osv-scan)
  👌 This is coming from the build tools (maven plugin), not shipped at runtime, FP for us.
  ·
- Vulnerabilities in: pkg:npm/highcharts@9.2.2 [CVE-2026-118251, CVE-2026-118250] (osv-scan)
  👌 Fixed in Vaadin Charts without bumping the bundled Highcharts (announced as CVE-2026-107588): fix: skip unsupported values in chart options (CP: 24.4) web-components#12919 ignores reserved segments in series.keys and point option names (CVE-2026-118250) and credits links without a supported URL scheme (CVE-2026-118251). The other Highcharts CVEs of the same disclosure do not affect 9.2.2. Scanners keep flagging 9.2.2 by version only; Vaadin 24.4 keeps Highcharts 9.x, the upgrade to 12.x happened in Vaadin 25.
  ·
- Vulnerabilities in: pkg:maven/me.friwi/jcef-api@jcef-99c2f7a%2Bcef-127.3.1%2Bg6cbb30e%2Bchromium-127.0.6533.100 [CVE-2024-21639, CVE-2024-21640] (owasp)
  👌 Wait for the update from the jcefmaven community. Meanwhile the swing-kit is supposed to be used with fixed websites and not to browse the internet, we have a check for that, so the only possible attacker would be the same person that created the swing application, aka our customer devs. so this vulnerability is not classified by us as critical issue
  · cpe:2.3:a:chromiumembedded:chromium_embedded_framework::::::::
- Vulnerabilities in: pkg:maven/com.vaadin/vaadin-core@24.4-SNAPSHOT [CVE-2026-2742, CVE-2026-2741] (owasp)
  👌 False positive: the scanners do not compare SNAPSHOT versions, the fixes are included in the 24.4 branch.
  · cpe:2.3:a:vaadin:vaadin::::::::
- Vulnerabilities in: pkg:maven/com.vaadin/vaadin-swing-kit-flow@2.3.0 [CVE-2021-33604] (owasp)
  👌 False positive: CVE-2021-33604 is an old flow-server issue, matched via the generic vaadin CPE.
  · cpe:2.3:a:vaadin:flow-server::::::::
  · cpe:2.3:a:vaadin:vaadin::::::::
🚫 Vulnerabilities:
- Vulnerabilities in: pkg:maven/ch.qos.logback/logback-core@1.4.14 [CVE-2025-11226, CVE-2024-12801, CVE-2026-10532, CVE-2026-9828, CVE-2024-12798, CVE-2026-1225] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/com.google.guava/guava@33.1.0-jre [CVE-2026-102554] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/com.vaadin/flow-server@24.4.21 [CVE-2026-2742] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/com.vaadin/vaadin@24.4.21 [CVE-2026-2742] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/io.opentelemetry/opentelemetry-api@1.23.0 [CVE-2026-118259, CVE-2026-45292, CVE-2026-39883, CVE-2026-24051, CVE-2026-39882, CVE-2026-41178, CVE-2026-44967, CVE-2026-54285] (osv-scan,owasp)
  ·
  · cpe:2.3:a:opentelemetry:opentelemetry::::::go::*
  · cpe:2.3:a:opentelemetry:opentelemetry:1.43.0:::::go::
  · cpe:2.3:a:opentelemetry:opentelemetry::::::c++::*
  · cpe:2.3:a:opentelemetry:opentelemetry::::::node.js::*
- Vulnerabilities in: pkg:maven/io.opentelemetry/opentelemetry-extension-trace-propagators@1.23.0 [CVE-2026-45292] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.apache.poi/poi-ooxml@5.2.5 [CVE-2025-31672] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.33 [BIT-tomcat-2025-55668, CVE-2025-55668, BIT-tomcat-2024-56337, CVE-2024-56337, BIT-tomcat-2025-49124, CVE-2025-49124, BIT-tomcat-2024-50379, CVE-2024-50379, BIT-tomcat-2026-43515, CVE-2026-43515, BIT-tomcat-2026-43513, CVE-2026-43513, BIT-tomcat-2025-24813, CVE-2025-24813, BIT-tomcat-2026-25854, CVE-2026-25854, BIT-tomcat-2026-43514, CVE-2026-43514, BIT-tomcat-2026-65905, CVE-2026-65905, BIT-tomcat-2025-31651, CVE-2025-31651, BIT-tomcat-2026-42498, CVE-2026-42498, BIT-tomcat-2026-65182, CVE-2026-65182, BIT-tomcat-2026-41284, CVE-2026-41284, BIT-tomcat-2025-46701, CVE-2025-46701, BIT-tomcat-2025-48988, CVE-2025-48988, BIT-tomcat-2026-68525, CVE-2026-68525, BIT-tomcat-2026-43512, CVE-2026-43512, BIT-tomcat-2025-61795, CVE-2025-61795, BIT-tomcat-2026-34483, CVE-2026-34483, BIT-tomcat-2025-55754, CVE-2025-55754, BIT-tomcat-2025-49125, CVE-2025-49125, BIT-tomcat-2025-55752, CVE-2025-55752, BIT-tomcat-2025-52520, CVE-2025-52520] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.33 [BIT-tomcat-2025-55668, CVE-2025-55668, BIT-tomcat-2025-53506, CVE-2025-53506, BIT-tomcat-2024-56337, CVE-2024-56337, BIT-tomcat-2025-31650, CVE-2025-31650, BIT-tomcat-2025-49124, CVE-2025-49124, BIT-tomcat-2026-24880, CVE-2026-24880, BIT-tomcat-2024-50379, CVE-2024-50379, BIT-tomcat-2026-43515, CVE-2026-43515, BIT-tomcat-2026-43513, CVE-2026-43513, BIT-tomcat-2025-24813, CVE-2025-24813, BIT-tomcat-2026-25854, CVE-2026-25854, BIT-tomcat-2026-43514, CVE-2026-43514, BIT-tomcat-2026-65905, CVE-2026-65905, BIT-tomcat-2025-31651, CVE-2025-31651, BIT-tomcat-2025-66614, CVE-2025-66614, BIT-tomcat-2026-42498, CVE-2026-42498, BIT-tomcat-2026-65182, CVE-2026-65182, BIT-tomcat-2025-48989, CVE-2025-48989, BIT-tomcat-2026-41284, CVE-2026-41284, BIT-tomcat-2025-46701, CVE-2025-46701, BIT-tomcat-2025-48988, CVE-2025-48988, BIT-tomcat-2026-68525, CVE-2026-68525, BIT-tomcat-2026-43512, CVE-2026-43512, BIT-tomcat-2025-61795, CVE-2025-61795, BIT-tomcat-2026-24734, CVE-2026-24734, BIT-tomcat-2026-41293, CVE-2026-41293, BIT-tomcat-2026-34483, CVE-2026-34483, BIT-tomcat-2025-55754, CVE-2025-55754, BIT-tomcat-2025-49125, CVE-2025-49125, BIT-tomcat-2025-55752, CVE-2025-55752, BIT-tomcat-2025-52520, CVE-2025-52520, BIT-tomcat-2026-34487, CVE-2026-34487, CVE-2026-29145, CVE-2026-53434, CVE-2026-55276, CVE-2026-59083, CVE-2026-59084, CVE-2026-65183, CVE-2026-66422, CVE-2026-68569, CVE-2026-29146, CVE-2026-65927, CVE-2026-68763, CVE-2026-53404, CVE-2026-55957, CVE-2026-73180, CVE-2026-34500, CVE-2026-55955, CVE-2026-55956, CVE-2026-50229, CVE-2024-54677, CVE-2026-66299, CVE-2026-24733] (osv-scan,owasp)
  ·
  · cpe:2.3:a:apache:tomcat::::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone1::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone10::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone11::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone12::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone13::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone14::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone15::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone16::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone17::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone18::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone19::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone2::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone20::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone21::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone22::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone23::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone24::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone25::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone26::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone27::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone3::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone4::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone5::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone6::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone7::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone8::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:milestone9::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone10::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone11::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone12::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone13::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone14::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone15::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone16::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone17::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone18::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone19::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone2::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone20::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone21::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone22::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone23::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone24::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone25::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone3::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone4::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone5::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone6::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone7::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone8::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone9::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone1::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone10::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone11::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone12::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone13::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone14::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone15::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone16::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone17::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone18::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone19::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone2::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone20::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone3::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone4::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone5::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone6::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone7::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone8::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:milestone9::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone1::::::
  · cpe:2.3:a:apache:tomcat:11.0.0:milestone26::::::
  · cpe:2.3:a:apache:tomcat_native::::::::
  · cpe:2.3:a:apache:tomcat:9.0.0:-::::::
  · cpe:2.3:a:apache:tomcat:10.1.0:-::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone1::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone10::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone2::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone3::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone4::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone5::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone6::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone7::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone8::::::
  · cpe:2.3:a:apache:tomcat:10.0.0:milestone9::::::
- Vulnerabilities in: pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.33 [BIT-tomcat-2025-53506, CVE-2025-53506, BIT-tomcat-2025-31650, CVE-2025-31650, BIT-tomcat-2026-24880, CVE-2026-24880, BIT-tomcat-2025-66614, CVE-2025-66614, BIT-tomcat-2025-48989, CVE-2025-48989, BIT-tomcat-2026-24734, CVE-2026-24734, BIT-tomcat-2026-41293, CVE-2026-41293] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.apache.tomcat/tomcat-embed-core@10.1.33 [BIT-tomcat-2024-56337, CVE-2024-56337] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.apache.tomcat/tomcat@10.1.33 [BIT-tomcat-2025-49124, CVE-2025-49124, BIT-tomcat-2026-43515, CVE-2026-43515, BIT-tomcat-2026-43513, CVE-2026-43513, BIT-tomcat-2026-25854, CVE-2026-25854, BIT-tomcat-2026-43514, CVE-2026-43514, BIT-tomcat-2026-65905, CVE-2026-65905, BIT-tomcat-2025-66614, CVE-2025-66614, BIT-tomcat-2026-42498, CVE-2026-42498, BIT-tomcat-2026-65182, CVE-2026-65182, BIT-tomcat-2026-41284, CVE-2026-41284, BIT-tomcat-2026-68525, CVE-2026-68525, BIT-tomcat-2026-43512, CVE-2026-43512, BIT-tomcat-2025-61795, CVE-2025-61795, BIT-tomcat-2026-41293, CVE-2026-41293, BIT-tomcat-2026-34483, CVE-2026-34483, BIT-tomcat-2025-55754, CVE-2025-55754, BIT-tomcat-2025-55752, CVE-2025-55752, BIT-tomcat-2026-34487, CVE-2026-34487] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.33 [BIT-tomcat-2026-34487, CVE-2026-34487] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.bitbucket.b_c/jose4j@0.9.5 [CVE-2024-29371] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.3.5 [CVE-2026-41001] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework.boot/spring-boot@3.3.5 [CVE-2025-22235, CVE-2026-40973, CVE-2026-40974, CVE-2026-22733, CVE-2026-40972, CVE-2026-40975, CVE-2026-40977, CVE-2026-41001] (osv-scan,owasp)
  ·
  · cpe:2.3:a:vmware:spring_boot::::::::
- Vulnerabilities in: pkg:maven/org.springframework.data/spring-data-commons@3.2.12 [CVE-2026-41721, CVE-2026-41711] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework.security/spring-security-crypto@6.2.8 [CVE-2025-22228] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.4 [CVE-2026-22748] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework.security/spring-security-web@6.3.4 [CVE-2026-47838, CVE-2026-22732, CVE-2026-41706, CVE-2026-40988, CVE-2026-22748, CVE-2026-41003, CVE-2026-41694, CVE-2026-22746] (osv-scan,owasp)
  · cpe:2.3:a:vmware:spring_security::::::::
- Vulnerabilities in: pkg:maven/org.springframework/spring-context@6.1.14 [CVE-2025-22233] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework/spring-core@6.1.14 [CVE-2026-41848, CVE-2025-41249, CVE-2026-41855, CVE-2026-47884, CVE-2026-47891, CVE-2026-47892, CVE-2026-59313, CVE-2026-59283, CVE-2026-41838, CVE-2026-41842, CVE-2026-41850, CVE-2026-41851, CVE-2026-47885, CVE-2026-47886, CVE-2026-47888, CVE-2026-47893, CVE-2026-59282, CVE-2026-22740, CVE-2026-41844, CVE-2026-41845, CVE-2026-41846, CVE-2026-47887, CVE-2026-59281, CVE-2026-22737, CVE-2026-41840, CVE-2026-41841, CVE-2026-41843, CVE-2026-22745, CVE-2026-41852, CVE-2026-41853, CVE-2026-59280, CVE-2026-41839, CVE-2026-59314, CVE-2026-22741, CVE-2026-22735] (osv-scan,owasp)
  · cpe:2.3:a:vmware:spring_framework::::::::
  ·
- Vulnerabilities in: pkg:maven/org.springframework/spring-expression@6.1.14 [CVE-2026-41852, CVE-2026-41850, CVE-2026-41851] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework/spring-web@6.1.15 [CVE-2025-41234, CVE-2026-41855, CVE-2026-47884, CVE-2026-47891, CVE-2026-47892, CVE-2026-59313, CVE-2026-59283, CVE-2026-41838, CVE-2026-41842, CVE-2026-41848, CVE-2026-41850, CVE-2026-41851, CVE-2026-47885, CVE-2026-47886, CVE-2026-47888, CVE-2026-47893, CVE-2026-59282, CVE-2026-22740, CVE-2026-41844, CVE-2026-41845, CVE-2026-41846, CVE-2026-47887, CVE-2026-59281, CVE-2026-22737, CVE-2026-41840, CVE-2026-41841, CVE-2026-41843, CVE-2026-22745, CVE-2026-41852, CVE-2026-41853, CVE-2026-59280, CVE-2026-41839, CVE-2026-59314, CVE-2026-22741, CVE-2026-22735] (osv-scan,owasp)
  ·
  · cpe:2.3:a:vmware:spring_framework::::::::
- Vulnerabilities in: pkg:maven/org.springframework/spring-webmvc@6.1.15 [CVE-2026-41845, CVE-2026-22737, CVE-2026-22735, CVE-2026-22745, CVE-2026-41843, CVE-2026-41846, CVE-2026-41853, CVE-2026-41844, CVE-2026-41841, CVE-2026-47884, CVE-2025-41242, CVE-2026-22741, CVE-2026-41842] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework/spring-webflux@6.1.15 [CVE-2026-22737, CVE-2026-22735, CVE-2026-22745, CVE-2026-41843, CVE-2026-41853, CVE-2026-41844, CVE-2026-41841, CVE-2026-22741, CVE-2026-41842] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.springframework/spring-websocket@6.1.15 [CVE-2025-41254, CVE-2026-41838] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/%40cyclonedx/cyclonedx-npm@2.1.0 [CVE-2026-71538, CVE-2026-55849] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/%40opentelemetry/core@1.8.0 [CVE-2026-54285] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/%40opentelemetry/core@1.9.0 [CVE-2026-54285] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/deepmerge@4.3.1 [CVE-2026-93753] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/esbuild@0.21.5 [] ()
  ·
- Vulnerabilities in: pkg:npm/js-yaml@3.14.1 [CVE-2026-84375, CVE-2026-59869, CVE-2026-53550, CVE-2025-64718] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/libxmljs2@0.35.0 [CVE-2024-34394] (osv-scan)
  👌 This is coming from the tools, @cyclonedx/cyclonedx, we have used for sbom module, FP for us.
  ·
- Vulnerabilities in: pkg:npm/path-to-regexp@2.4.0 [CVE-2024-45296, CVE-2026-4867, GHSA-37ch-88jc-xwx2] (osv-scan)
  👌 From vaadin-rounte:1.7.5. Very low impact for us since we're only running that code in the user's browser and the only impact is a degraded performance.
  ·
- Vulnerabilities in: pkg:npm/react-router@6.30.6 [CVE-2026-53666, CVE-2026-53669] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/tar@6.2.1 [CVE-2026-59873, CVE-2026-24842, CVE-2026-26960, CVE-2026-23745, CVE-2026-59874, CVE-2026-31802, CVE-2026-59875, CVE-2026-29786, CVE-2026-73566, CVE-2026-23950, CVE-2026-53655, CVE-2026-59871] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/vite@5.4.21 [CVE-2026-39365, CVE-2026-112942, CVE-2026-112943, CVE-2026-112945, CVE-2026-53571, CVE-2026-112944, CVE-2026-112946, CVE-2026-53632] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/launch-editor@5.4.21 [CVE-2026-112942, CVE-2026-112943, CVE-2026-112944, CVE-2026-53632] (osv-scan)
  ·
- Vulnerabilities in: pkg:npm/vite-plus@5.4.21 [CVE-2026-112942, CVE-2026-112943, CVE-2026-112945, CVE-2026-53571, CVE-2026-112944, CVE-2026-112946, CVE-2026-53632] (osv-scan)
  ·
- Vulnerabilities in: pkg:maven/org.jetbrains.kotlin/kotlin-stdlib@1.9.20 [CVE-2026-53914, CVE-2020-29582] (owasp)
  · cpe:2.3:a:jetbrains:kotlin::::::::
  · cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:::::::*
  · cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:::::::*
  · cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:::::::*
- Vulnerabilities in: pkg:maven/org.apache.logging.log4j/log4j-to-slf4j@2.21.1 [CVE-2026-34479, CVE-2026-34477, CVE-2026-49844] (owasp)
  · cpe:2.3:a:apache:log4j::::::::
  · cpe:2.3:a:apache:log4j:3.0.0:alpha1::::::
  · cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1::::::
  · cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2::::::
  · cpe:2.3:a:apache:log4j:3.0.0:beta1::::::
  · cpe:2.3:a:apache:log4j:3.0.0:beta2::::::
  · cpe:2.3:a:apache:log4j:3.0.0:beta3::::::
  · cpe:2.3:a:apache:log4j:2.26.0:::::::*
- Vulnerabilities in: pkg:maven/io.opentelemetry/opentelemetry-common@1.66.0 [CVE-2026-54285] (owasp)
  · cpe:2.3:a:opentelemetry:opentelemetry::::::node.js::*
- Vulnerabilities in: pkg:maven/io.opentelemetry/opentelemetry-semconv@1.23.0-alpha [CVE-2026-39883, CVE-2026-24051, CVE-2026-39882, CVE-2026-41178, CVE-2026-44967, CVE-2026-54285] (owasp)
  · cpe:2.3:a:opentelemetry:opentelemetry::::::go::*
  · cpe:2.3:a:opentelemetry:opentelemetry:1.43.0:::::go::
  · cpe:2.3:a:opentelemetry:opentelemetry::::::c++::*
  · cpe:2.3:a:opentelemetry:opentelemetry::::::node.js::*
- Vulnerabilities in: pkg:maven/org.apache.poi/poi@5.2.5 [CVE-2025-31672] (owasp)
  · cpe:2.3:a:apache:poi::::::::
  · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::linux::
  · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
  · cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::
- Vulnerabilities in: pkg:maven/io.projectreactor.netty/reactor-netty-core@1.2.18 [CVE-2026-47874] (owasp)
  · cpe:2.3:a:pivotal:reactor_netty::::::::
- Vulnerabilities in: pkg:maven/org.springframework.security/spring-security-core@6.2.8 [CVE-2026-22748] (owasp)
  · cpe:2.3:a:vmware:spring_security::::::::
- Vulnerabilities in: pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.4 [CVE-2026-22732, CVE-2026-47838, CVE-2026-40988, CVE-2026-22748, CVE-2026-41706, CVE-2026-41003, CVE-2026-41694, CVE-2026-22746] (owasp)
  · cpe:2.3:a:vmware:spring_security::::::::
- Vulnerabilities in: pkg:javascript/quill@1.3.6 [CVE-2021-3163, GHSA-588m-9qg5-35pq] (owasp)
  · cpe:2.3:a:slab:quill:4.8.0:::::node.js::
📔 No License Issues

[Click for more Details]

totally-not-ai Bot requested a review from ZheSun88 October 30, 2026 10:14

ZheSun88 marked this pull request as ready for review October 30, 2026 15:56

Merge branch '24.4' into chore/sbom-notes-highcharts-24.4

fbeda84

ZheSun88 approved these changes Oct 30, 2026

View reviewed changes

ZheSun88 enabled auto-merge (squash) October 30, 2026 15:56

ZheSun88 merged commit 78e3d3a into 24.4 Oct 30, 2026
3 of 4 checks passed

ZheSun88 deleted the chore/sbom-notes-highcharts-24.4 branch October 30, 2026 16:12

Navigation Menu

Repository navigation

chore: add SBOM notes for highcharts 9.2.2 (CP: 24.4) - #9770

chore: add SBOM notes for highcharts 9.2.2 (CP: 24.4)#9770
ZheSun88 merged 2 commits into
24.4from
chore/sbom-notes-highcharts-24.4

totally-not-ai Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

totally-not-ai Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

Test summary

Uh oh!

github-actions Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependencies Report

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

totally-not-ai Bot commented Oct 30, 2026 •

edited

Loading

github-actions Bot commented Oct 30, 2026 •

edited

Loading