agentprime: spring-integrationEvery new CVE for spring-integration.https://agentprime.io/CVE-2026-59324: fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunctionhttps://agentprime.io/advisories/CVE-2026-59324/https://agentprime.io/advisories/CVE-2026-59324/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 18:04:51 GMTCVECVE-2026-59322: EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeadershttps://agentprime.io/advisories/CVE-2026-59322/https://agentprime.io/advisories/CVE-2026-59322/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 18:04:50 GMTCVECVE-2026-59321: Shared JSR-223 ScriptEngine evaluated concurrently without THREADING checkhttps://agentprime.io/advisories/CVE-2026-59321/https://agentprime.io/advisories/CVE-2026-59321/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 18:04:49 GMTCVECVE-2026-59311: Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creationhttps://agentprime.io/advisories/CVE-2026-59311/https://agentprime.io/advisories/CVE-2026-59311/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 18:04:40 GMTCVECVE-2026-59307: Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale referencehttps://agentprime.io/advisories/CVE-2026-59307/https://agentprime.io/advisories/CVE-2026-59307/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 17:58:02 GMTCVECVE-2026-59293: SMB minimum protocol dialect defaults to SMB1https://agentprime.io/advisories/CVE-2026-59293/https://agentprime.io/advisories/CVE-2026-59293/CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 17:57:51 GMTCVECVE-2026-59292: World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)https://agentprime.io/advisories/CVE-2026-59292/https://agentprime.io/advisories/CVE-2026-59292/CVSS 3.2 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 17:57:50 GMTCVECVE-2026-59274: Unbounded decompression in UnZipTransformer enables zip-bomb DoShttps://agentprime.io/advisories/CVE-2026-59274/https://agentprime.io/advisories/CVE-2026-59274/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 05:20:35 GMTCVECVE-2026-47880: DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant nameshttps://agentprime.io/advisories/CVE-2026-47880/https://agentprime.io/advisories/CVE-2026-47880/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 05:20:25 GMTCVECVE-2026-47864: Unsafe Java deserialization in SerializingHttpMessageConverter — remote code executionhttps://agentprime.io/advisories/CVE-2026-47864/https://agentprime.io/advisories/CVE-2026-47864/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 05:06:24 GMTCVECVE-2026-47861: UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=falsehttps://agentprime.io/advisories/CVE-2026-47861/https://agentprime.io/advisories/CVE-2026-47861/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Aug 2026 23:49:25 GMTCVECVE-2026-47862: ZipTransformer uses file_name header to build workDirectory path without sanitizationhttps://agentprime.io/advisories/CVE-2026-47862/https://agentprime.io/advisories/CVE-2026-47862/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Aug 2026 23:28:47 GMTCVECVE-2026-47859: Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoShttps://agentprime.io/advisories/CVE-2026-47859/https://agentprime.io/advisories/CVE-2026-47859/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Aug 2026 23:28:45 GMTCVECVE-2026-47856: JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-listhttps://agentprime.io/advisories/CVE-2026-47856/https://agentprime.io/advisories/CVE-2026-47856/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Aug 2026 23:28:43 GMTCVE