StackRadar

CVE-2026-47884

Critical

Advisory

Published 27 Aug 2026In the index since 6 Oct 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.006
47th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
367
of 18,026 indexed, latest versions
Container images
328
deployed by those charts
Fix available
1 of 1
affected package

Spring Framework Improper Path Limitation in XsltView

Carried by container images the latest versions of 367 of 18,026 indexed charts deploy, on 328 images.

Affected packageAffected versionsFixed inImages
spring-webmvcmaven2.5.6, 2.5.6.SEC03, 3.2.18.RELEASE, 4.3.1.RELEASE+99 more7.0.9328
OSV records
GHSA-pc63-qcmh-9cmg

Charts affected

367 by stars
ChartLatestAffected imagesRadar Score
bpjstk-serviceopenshift1.0.05 of 6See more

bpjstk-service openshift 1.0.0

5 of the 6 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
andrianrf/backoffice-be:latest6036614803d4
spring-webmvc@5.3.27
no fix listed
andrianrf/bpjstk-service:latest46abe878d9d8
spring-webmvc@5.2.9.RELEASE
no fix listed
andrianrf/bpjstk-simulator:latestb63fdb51d39d
spring-webmvc@5.2.9.RELEASE
no fix listed
andrianrf/iso-client:latestba560086ce15
spring-webmvc@5.2.9.RELEASE
no fix listed
andrianrf/iso-server:latest7da47f525c7d
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

36,561
cp-cmfopenshift2.4.11 of 1See more

cp-cmf openshift 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
confluentinc/cp-cmf:2.4.1f466f8649aa8
spring-webmvc@6.2.19
no fix listed

Open the chart page →

318
fineractopenshift0.1.11 of 4See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
spring-webmvc@6.2.5
no fix listed

Open the chart page →

8,944
redhat-springboot-restopenshift0.0.11 of 1See more

redhat-springboot-rest openshift 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
quay.io/snowdrop/spring-boot-rest-http-example:2.7b1a054613715
spring-webmvc@5.3.31
no fix listed

Open the chart page →

3,562
smsf-configurationopenshift1.0.41 of 1See more

smsf-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
gurolakman/smsf-configuration:1.0.49abb3882bcbd
spring-webmvc@5.3.18
no fix listed

Open the chart page →

13,923
smsf-momtopenshift1.0.41 of 1See more

smsf-momt openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
gurolakman/smsf-momt:1.0.4ce23b20a8a17
spring-webmvc@5.3.18
no fix listed

Open the chart page →

13,901
smsf-registrationopenshift1.0.41 of 1See more

smsf-registration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
gurolakman/smsf-registration:1.0.4b22e746edd5d
spring-webmvc@5.3.18
no fix listed

Open the chart page →

13,883
ussigw-configurationopenshift1.0.41 of 1See more

ussigw-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
spring-webmvc@5.3.18
no fix listed

Open the chart page →

13,771
ussigw-coreopenshift1.0.41 of 1See more

ussigw-core openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
gurolakman/ussigw-core:1.0.48739565c3ea2
spring-webmvc@5.3.18
no fix listed

Open the chart page →

13,428
operatonoperatonVerified publisher1.0.51 of 1See more

operaton operaton 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
operaton/operaton:1.0.0-beta-4b35867ffe4d8
spring-webmvc@6.2.5
no fix listed

Open the chart page →

2,378
issuegenopsmxVerified publisher1.0.21 of 1See more

issuegen opsmx 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
opsmx11/issuegen:v2.1.05c50ca123d88
spring-webmvc@5.1.10.RELEASE
no fix listed

Open the chart page →

26,985
opsmx-autopilotopsmxVerified publisher2.0.01 of 2See more

opsmx-autopilot opsmx 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
opsmxdev/ubi8-autopilot:v2.9.10-202006181240c7e4ea797f11
spring-webmvc@5.2.5.RELEASE
no fix listed

Open the chart page →

40,013
rest-appopsmxVerified publisher0.1.01 of 1See more

rest-app opsmx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
opsmx11/restapp:0.1.0c76b995be1fb
spring-webmvc@5.1.3.RELEASE
no fix listed

Open the chart page →

5,758
pagespages1.0.01 of 3See more

pages pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-10.1.01 of 1See more

pages pages-1 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:1.04d2eb25b9225
spring-webmvc@5.3.4
no fix listed

Open the chart page →

10,783
pagespages101.0.01 of 3See more

pages pages10 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages1111.0.01 of 3See more

pages pages111 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages21.0.01 of 3See more

pages pages2 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-alexchmielu1.0.01 of 3See more

pages pages-alexchmielu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-alps1.0.01 of 3See more

pages pages-alps 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-alstom1.0.01 of 3See more

pages pages-alstom 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-ambala1.0.01 of 3See more

pages pages-ambala 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-andromeda1.0.01 of 3See more

pages pages-andromeda 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespagesbadami1.0.01 of 3See more

pages pagesbadami 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-blackburn1.0.01 of 3See more

pages pages-blackburn 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-botes1.0.01 of 3See more

pages pages-botes 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-brian1.0.01 of 3See more

pages pages-brian 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-buckll1.0.01 of 3See more

pages pages-buckll 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-camden1.0.01 of 3See more

pages pages-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-camden7711.0.01 of 3See more

pages pages-camden771 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-diarmuidkeane1.0.01 of 3See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-draco1.0.01 of 3See more

pages pages-draco 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-ellora1.0.01 of 3See more

pages pages-ellora 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-finchley1.0.01 of 3See more

pages pages-finchley 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-fornax1.0.01 of 3See more

pages pages-fornax 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-harsh1.0.01 of 3See more

pages pages-harsh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespagesk1.0.01 of 3See more

pages pagesk 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-microservice-ashim1.0.01 of 3See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-mihai1.0.01 of 3See more

pages pages-mihai 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-nivesh1.0.01 of 3See more

pages pages-nivesh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespagessandeepgudu1.0.01 of 3See more

pages pagessandeepgudu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-shubhanker1.0.01 of 3See more

pages pages-shubhanker 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-ssharma09091.0.01 of 3See more

pages pages-ssharma0909 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-sucharitha1.0.01 of 3See more

pages pages-sucharitha 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-sudhir1.0.01 of 3See more

pages pages-sudhir 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-sushi1.0.01 of 3See more

pages pages-sushi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-vasanth58141.0.01 of 3See more

pages pages-vasanth5814 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
pagespages-vjp1.0.01 of 3See more

pages pages-vjp 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
helloworldpauls-helm-charts2.0.01 of 1See more

helloworld pauls-helm-charts 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
paulczar/spring-helloworld:latestc7140cecd5f7
spring-webmvc@5.1.5.RELEASE
no fix listed

Open the chart page →

5,850
pagespawan-pages1.0.01 of 3See more

pages pawan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150

Container images carrying it

328 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
andrianrf/bpjstk-service:latest46abe878d9d8
spring-webmvc@5.2.9.RELEASE
no fix listed
1
andrianrf/bpjstk-simulator:latestb63fdb51d39d
spring-webmvc@5.2.9.RELEASE
no fix listed
1
andrianrf/iso-client:latestba560086ce15
spring-webmvc@5.2.9.RELEASE
no fix listed
1
andrianrf/iso-server:latest7da47f525c7d
spring-webmvc@5.2.7.RELEASE
no fix listed
1
anguda/ant-media:2.5c435285fc241
spring-webmvc@5.3.20
no fix listed
1
anthonyraymond/joal:2.1.37fc942567c564
spring-webmvc@5.3.22
no fix listed
1
apache/hertzbeat:1.8.075d48a62748f
spring-webmvc@6.2.2
no fix listed
1
apache/hertzbeat-collector:1.8.0a2bab1be574c
spring-webmvc@6.2.2
no fix listed
1
apache/iotdb:0.11.28647309f95d1
spring-webmvc@4.3.18.RELEASE
no fix listed
1
apache/nifi-registry:1.14.0090b7f87ec7f
spring-webmvc@5.3.8
no fix listed
1
apache/nifi-registry:1.27.063b8e3e40742
spring-webmvc@5.3.37
no fix listed
1
apache/nifi-registry:0.8.0974efa2f21da
spring-webmvc@5.2.5.RELEASE
no fix listed
1
apache/rocketmq-exporter:0.0.2c8fb51195444
spring-webmvc@5.3.27
no fix listed
1
apache/shenyu-admin:2.5.1e2be712fc4f4
spring-webmvc@5.3.20
no fix listed
1
apache/skywalking-ui:6.5.0a84f9d9b8067
spring-webmvc@4.3.15.RELEASE
no fix listed
1
aroralalit/student-producer:1.0.02a094f597b36
spring-webmvc@5.3.27
no fix listed
1
arturisimo/webapp-db-java:v2c95524e90b57
spring-webmvc@5.3.15
no fix listed
1
assistiot/tacticle_dashboard:api-lateste4414cb72dc4
spring-webmvc@5.3.20
no fix listed
1
atlassian/bamboo:12.1.119160c3bfb73b
spring-webmvc@6.2.19
no fix listed
1
atlassian/bitbucket:10.2.705933f2b1cfd
spring-webmvc@6.2.19
no fix listed
1
atlassian/confluence-server:7.10.03b9222ab32ef
spring-webmvc@5.1.18.RELEASE
no fix listed
1
atlassian/crowd:7.2.351e6d33676f6
spring-webmvc@6.2.19
no fix listed
1
atlassian/crowd:5.2.2799a49be18d7
spring-webmvc@5.3.30
no fix listed
1
atlassian/jira-software:11.3.114046f4a668a4
spring-webmvc@6.2.19
no fix listed
1
audig/clamapi:2.1.62c3fe34ee430
spring-webmvc@5.2.8.RELEASE
no fix listed
1
beastob/url-shortener:1.0.299a49885ab33
spring-webmvc@5.3.10
no fix listed
1
binhex/arch-nzbhydra2:3.1.0-1-01fb8952921ab6
spring-webmvc@5.2.7.RELEASE
no fix listed
1
blackducksoftware/blackduck-alert:8.4.1b66c8385ba53
spring-webmvc@6.1.21
no fix listed
1
bluerange/bluerange:26.2.0503577ef9143
spring-webmvc@6.2.6
no fix listed
1
castlemock/castlemock:latestb7f3f1527ba9
spring-webmvc@6.2.5
no fix listed
1
cbioportal/cbioportal:6.4.1-web-shenandoah08debbd2dbf9
spring-webmvc@6.2.11
no fix listed
1
chandanteekinavar/findery-market-order-service:1.00cf52bf5ee9a
spring-webmvc@5.3.10
no fix listed
1
choerodon/event-store-service:0.8.03c94c97f6f69
spring-webmvc@4.3.8.RELEASE
no fix listed
1
cnieg/gantt:1.1.2d4b478d76f2a
spring-webmvc@5.3.23
no fix listed
1
commerceexperts/smartquery-service:2.2.09e33ad89baf6
spring-webmvc@5.3.29
no fix listed
1
confluentinc/cp-cmf:2.4.1f466f8649aa8
spring-webmvc@6.2.19
no fix listed
1
craigwillis/c2metadata-bd:latestae317d7e4724
spring-webmvc@4.3.3.RELEASE
no fix listed
1
dannielkil/book-backend:lateste3b479a55a69
spring-webmvc@5.3.22
no fix listed
1
dellcloud/category:distributed02fc234353a9
spring-webmvc@5.2.7.RELEASE
no fix listed
1
dellcloud/pages:1.04d2eb25b9225
spring-webmvc@5.3.4
no fix listed
1
eclipseaerios/entrypoint-balancer:1.3.043cd999a008d
spring-webmvc@6.1.5
no fix listed
1
eclipseaerios/management-portal-backend:1.2.215fba526a4f8
spring-webmvc@6.1.4
no fix listed
1
elastictranscoder/media:627e21dc963ab3858c6b
spring-webmvc@5.3.8
no fix listed
1
elastictranscoder/media-storage:f6d861a026208b8c2359
spring-webmvc@5.3.8
no fix listed
1
elastictranscoder/transcoder:627e21dcb4a0327029e6
spring-webmvc@5.3.8
no fix listed
1
elastictranscoder/transcoder-handler:627e21dc5b75d19e2733
spring-webmvc@5.3.8
no fix listed
1
epam/ai-dial-admin-backend:0.21.08b91130e3731
spring-webmvc@6.2.19
no fix listed
1
ephraimglick/ten-percent:latestba4cce835974
spring-webmvc@5.3.5
no fix listed
1
erudikaltd/scoold:1.66.0949c56b57e8f
spring-webmvc@7.0.3
7.0.9
1
fabioformosa/hello-world-api:latest063873af085c
spring-webmvc@6.2.5
no fix listed
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.