Update dependency org.eclipse.jetty:jetty-server to v12 - #60
Update dependency org.eclipse.jetty:jetty-server to v12#60dev-mend-for-github-com[bot] wants to merge 1 commit into
Security Report
❌ New vulnerabilities:
| Vulnerability | Severity |  CVSS Score |
Vulnerable Library | Direct Library | Suggested Fix | Issue |
|---|---|---|---|---|---|---|
CVE-740203-96098Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20260726042606_HNQJOV/python_TYINND/202607260426061/env/lib/python3.10/site-packages/six-1.17.0.dist-info Dependency Hierarchy: -> pinecone_client-6.0.0-py3-none-any.whl (Root Library) -> python_dateutil-2.9.0.post0-py2.py3-none-any.whl -> ❌ six-1.17.0-py2.py3-none-any.whl (Vulnerable Library) |
 Critical |
9.8 | Transitive six-1.17.0-py2.py3-none-any.whl |
pinecone_client-6.0.0-py3-none-any.whl | None | |
CVE-2024-27444Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20260726042606_HNQJOV/python_TYINND/202607260426061/env/lib/python3.10/site-packages/langchain-0.0.331.dist-info Dependency Hierarchy: -> ❌ langchain-0.0.331-py3-none-any.whl (Vulnerable Library) |
Critical |
9.8 | Direct langchain-0.0.331-py3-none-any.whl |
langchain-0.0.331-py3-none-any.whl | https://github.com/langchain-ai/langchain.git - no_fix | None |
CVE-2024-28088Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20260726042606_HNQJOV/python_TYINND/202607260426061/env/lib/python3.10/site-packages/langchain-0.0.331.dist-info Dependency Hierarchy: -> ❌ langchain-0.0.331-py3-none-any.whl (Vulnerable Library) |
 High |
8.1 | Direct langchain-0.0.331-py3-none-any.whl |
langchain-0.0.331-py3-none-any.whl | langchain-core - 0.1.30,langchain - 0.0.339 | None |
CVE-2026-45134Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20260726042606_HNQJOV/python_TYINND/202607260426061/env/lib/python3.10/site-packages/langchain-0.0.331.dist-info Dependency Hierarchy: -> ❌ langchain-0.0.331-py3-none-any.whl (Vulnerable Library) |
High |
7.1 | Direct langchain-0.0.331-py3-none-any.whl |
langchain-0.0.331-py3-none-any.whl | 0.8.0 | None |
CVE-2026-45134Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20260726042606_HNQJOV/python_TYINND/202607260426061/env/lib/python3.10/site-packages/langsmith-0.0.92.dist-info Dependency Hierarchy: -> langchain-0.0.331-py3-none-any.whl (Root Library) -> ❌ langsmith-0.0.92-py3-none-any.whl (Vulnerable Library) |
High |
7.1 | Transitive langsmith-0.0.92-py3-none-any.whl |
langchain-0.0.331-py3-none-any.whl | Transitive 0.8.0 |
None |
CVE-2024-2057Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20260726042606_HNQJOV/python_TYINND/202607260426061/env/lib/python3.10/site-packages/langchain-0.0.331.dist-info Dependency Hierarchy: -> ❌ langchain-0.0.331-py3-none-any.whl (Vulnerable Library) |
 Medium |
6.3 | Direct langchain-0.0.331-py3-none-any.whl |
langchain-0.0.331-py3-none-any.whl | langchain - 0.1.12 | None |
CVE-2026-41182Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20260726042606_HNQJOV/python_TYINND/202607260426061/env/lib/python3.10/site-packages/langsmith-0.0.92.dist-info Dependency Hierarchy: -> langchain-0.0.331-py3-none-any.whl (Root Library) -> ❌ langsmith-0.0.92-py3-none-any.whl (Vulnerable Library) |
Medium |
5.3 | Transitive langsmith-0.0.92-py3-none-any.whl |
langchain-0.0.331-py3-none-any.whl | Transitive https://github.com/langchain-ai/langsmith-sdk.git - v0.7.31 |
None |
CVE-2026-33558Dependency Hierarchy: -> nifi-aws-abstract-processors-2.0.0-SNAPSHOT.jar (Root Library) -> amazon-kinesis-client-2.5.3.jar -> schema-registry-serde-1.1.17.jar -> ❌ kafka-clients-3.6.0.jar (Vulnerable Library) |
Medium |
5.3 | Transitive kafka-clients-3.6.0.jar |
nifi-aws-abstract-processors-2.0.0-SNAPSHOT.jar | Transitive 3.9.2 |
None |
CVE-2026-33558Path to dependency file: /nifi-registry/nifi-registry-extensions/nifi-registry-ranger/nifi-registry-ranger-plugin/pom.xml Path to vulnerable library: /nifi-registry/nifi-registry-extensions/nifi-registry-ranger/nifi-registry-ranger-plugin/pom.xml,/nifi-nar-bundles/nifi-atlas-bundle/nifi-atlas-nar/pom.xml Dependency Hierarchy: -> nifi-atlas-reporting-task-2.0.0-SNAPSHOT.jar (Root Library) -> atlas-notification-2.3.0.jar -> atlas-client-v1-2.3.0.jar -> atlas-common-2.3.0.jar -> ❌ kafka-clients-2.8.1.jar (Vulnerable Library) |
Medium |
5.3 | Transitive kafka-clients-2.8.1.jar |
nifi-atlas-reporting-task-2.0.0-SNAPSHOT.jar | Transitive 3.9.2 |
#23 |
CVE-2026-33558Dependency Hierarchy: -> amazon-kinesis-client-2.5.3.jar (Root Library) -> schema-registry-serde-1.1.17.jar -> ❌ kafka-clients-3.6.0.jar (Vulnerable Library) |
Medium |
5.3 | Transitive kafka-clients-3.6.0.jar |
amazon-kinesis-client-2.5.3.jar | Transitive 3.9.2 |
None |
CVE-2026-33558Dependency Hierarchy: -> nifi-aws-processors-2.0.0-SNAPSHOT.jar (Root Library) -> nifi-aws-abstract-processors-2.0.0-SNAPSHOT.jar -> amazon-kinesis-client-2.5.3.jar -> schema-registry-serde-1.1.17.jar -> ❌ kafka-clients-3.6.0.jar (Vulnerable Library) |
Medium |
5.3 | Transitive kafka-clients-3.6.0.jar |
nifi-aws-processors-2.0.0-SNAPSHOT.jar | Transitive 3.9.2 |
None |
CVE-2026-33558Path to dependency file: /nifi-registry/nifi-registry-extensions/nifi-registry-ranger/nifi-registry-ranger-plugin/pom.xml Path to vulnerable library: /nifi-registry/nifi-registry-extensions/nifi-registry-ranger/nifi-registry-ranger-plugin/pom.xml,/nifi-nar-bundles/nifi-atlas-bundle/nifi-atlas-nar/pom.xml Dependency Hierarchy: -> ranger-plugins-common-2.4.0.jar (Root Library) -> ranger-plugins-audit-2.4.0.jar -> ❌ kafka-clients-2.8.1.jar (Vulnerable Library) |
Medium |
5.3 | Transitive kafka-clients-2.8.1.jar |
ranger-plugins-common-2.4.0.jar | Transitive 3.9.2 |
#13 |
CVE-2026-33558Path to dependency file: /nifi-nar-bundles/nifi-kafka-bundle/nifi-kafka-2-6-processors/pom.xml Path to vulnerable library: /nifi-nar-bundles/nifi-kafka-bundle/nifi-kafka-2-6-processors/pom.xml,/nifi-nar-bundles/nifi-kafka-bundle/nifi-kafka-2-6-nar/pom.xml Dependency Hierarchy: -> ❌ kafka-clients-2.6.3.jar (Vulnerable Library) |
Medium |
5.3 | Direct kafka-clients-2.6.3.jar |
kafka-clients-2.6.3.jar | 3.9.2 | None |
CVE-2026-10051Path to dependency file: /minifi/minifi-bootstrap/pom.xml Path to vulnerable library: /minifi/minifi-bootstrap/pom.xml Dependency Hierarchy: -> ❌ jetty-server-12.0.35.jar (Vulnerable Library) |
Medium |
5.3 | Direct jetty-server-12.0.35.jar |
jetty-server-12.0.35.jar | 12.0.36 | None |
CVE-2026-55443Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20260726042606_HNQJOV/python_TYINND/202607260426061/env/lib/python3.10/site-packages/langchain-0.0.331.dist-info Dependency Hierarchy: -> ❌ langchain-0.0.331-py3-none-any.whl (Vulnerable Library) |
Medium |
5.1 | Direct langchain-0.0.331-py3-none-any.whl |
langchain-0.0.331-py3-none-any.whl | 1.3.9 | None |
CVE-2024-8309Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20260726042606_HNQJOV/python_TYINND/202607260426061/env/lib/python3.10/site-packages/langchain-0.0.331.dist-info Dependency Hierarchy: -> ❌ langchain-0.0.331-py3-none-any.whl (Vulnerable Library) |
Medium |
4.9 | Direct langchain-0.0.331-py3-none-any.whl |
langchain-0.0.331-py3-none-any.whl | langchain - 0.2.0,langchain-community - 0.2.19,langchain - 0.2.0,langchain-community - 0.2.19,langchain-community - 0.2.19 | None |
CVE-2024-7042Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20260726042606_HNQJOV/python_TYINND/202607260426061/env/lib/python3.10/site-packages/langchain-0.0.331.dist-info Dependency Hierarchy: -> ❌ langchain-0.0.331-py3-none-any.whl (Vulnerable Library) |
Medium |
4.9 | Direct langchain-0.0.331-py3-none-any.whl |
langchain-0.0.331-py3-none-any.whl | https://github.com/langchain-ai/langchainjs.git - no_fix | None |
CVE-2024-3095Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20260726042606_HNQJOV/python_TYINND/202607260426061/env/lib/python3.10/site-packages/langchain-0.0.331.dist-info Dependency Hierarchy: -> ❌ langchain-0.0.331-py3-none-any.whl (Vulnerable Library) |
Medium |
4.8 | Direct langchain-0.0.331-py3-none-any.whl |
langchain-0.0.331-py3-none-any.whl | langchain-community - 0.2.9 | None |
CVE-2024-2965Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20260726042606_HNQJOV/python_TYINND/202607260426061/env/lib/python3.10/site-packages/langchain-0.0.331.dist-info Dependency Hierarchy: -> ❌ langchain-0.0.331-py3-none-any.whl (Vulnerable Library) |
Medium |
4.2 | Direct langchain-0.0.331-py3-none-any.whl |
langchain-0.0.331-py3-none-any.whl | langchain-community - 0.2.5,langchain - 0.2.5 | None |
CVE-2024-0243Path to dependency file: /nifi-python-extensions/nifi-text-embeddings-module/src/main/python/vectorstores/requirements.txt Path to vulnerable library: /tmp/ws-ua_20260726042606_HNQJOV/python_TYINND/202607260426061/env/lib/python3.10/site-packages/langchain-0.0.331.dist-info Dependency Hierarchy: -> ❌ langchain-0.0.331-py3-none-any.whl (Vulnerable Library) |
 Low |
3.7 | Direct langchain-0.0.331-py3-none-any.whl |
langchain-0.0.331-py3-none-any.whl | langchain - 0.1.0,langchain - 0.1.0,langchain - 0.1.0 | None |
✔️ Remediated vulnerabilities:
| Vulnerability | Vulnerable Library |
|---|---|
| CVE-2025-69226 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2026-34519 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-853521-722872 | commons-pool-1.5.4.jar |
| CVE-2025-69225 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2025-62727 | starlette-0.27.0-py3-none-any.whl |
| CVE-2025-69227 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2026-0994 | protobuf-4.24.4-cp37-abi3-manylinux2014_x86_64.whl |
| CVE-2025-66471 | urllib3-2.0.7-py3-none-any.whl |
| CVE-2024-52304 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2026-34518 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2026-45409 | idna-3.6-py3-none-any.whl |
| CVE-2026-34516 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2025-69223 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2026-34517 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2026-34515 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2025-69224 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2026-54279 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2025-54121 | starlette-0.27.0-py3-none-any.whl |
| CVE-2026-34514 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2021-34141 | numpy-1.21.6-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl |
| CVE-2026-34513 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2024-5569 | zipp-3.15.0-py3-none-any.whl |
| CVE-2024-23945 | hive-service-3.1.3.jar |
| CVE-2025-53643 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2023-49082 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2026-2332 | jetty-http-10.0.18.jar |
| CVE-2026-47065 | mina-core-2.2.3.jar |
| CVE-2023-49081 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2026-41635 | mina-core-2.2.3.jar |
| CVE-2025-68146 | filelock-3.12.2-py3-none-any.whl |
| WS-2023-0180 | sympy-1.10.1-py3-none-any.whl |
| CVE-2025-50181 | urllib3-2.0.7-py3-none-any.whl |
| CVE-2024-3651 | idna-3.6-py3-none-any.whl |
| CVE-2025-50182 | urllib3-2.0.7-py3-none-any.whl |
| CVE-2024-24762 | fastapi-0.103.2-py3-none-any.whl |
| CVE-2019-20444 | netty-3.10.6.Final.jar |
| CVE-2019-0205 | libthrift-0.9.3.jar |
| CVE-2018-11798 | libthrift-0.9.3.jar |
| CVE-2026-44431 | urllib3-2.0.7-py3-none-any.whl |
| CVE-2026-34520 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2024-7708 | jetty-server-10.0.18.jar |
| CVE-2024-39689 | certifi-2023.11.17-py3-none-any.whl |
| CVE-2023-50298 | solr-solrj-streaming-9.4.0.jar |
| CVE-2025-43859 | h11-0.14.0-py3-none-any.whl |
| CVE-2025-67721 | aircompressor-0.10.jar |
| CVE-2026-6790 | jetty-server-10.0.18.jar |
| CVE-2025-69230 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2024-52046 | mina-core-2.2.3.jar |
| CVE-2026-22815 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2026-34525 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2020-13949 | libthrift-0.9.3.jar |
| CVE-2024-27306 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2024-47874 | starlette-0.27.0-py3-none-any.whl |
| CVE-2023-34610 | json-io-2.5.1.jar |
| CVE-2026-43869 | libthrift-0.9.3.jar |
| CVE-2024-37891 | urllib3-2.0.7-py3-none-any.whl |
| CVE-2024-30251 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2024-23953 | hive-llap-common-3.1.3.jar |
| CVE-2018-1320 | libthrift-0.9.3.jar |
| CVE-2026-25645 | requests-2.31.0-py3-none-any.whl |
| CVE-2026-21441 | urllib3-2.0.7-py3-none-any.whl |
| CVE-2024-35195 | requests-2.31.0-py3-none-any.whl |
| CVE-2024-47081 | requests-2.31.0-py3-none-any.whl |
| CVE-2025-66418 | urllib3-2.0.7-py3-none-any.whl |
| CVE-2024-6763 | jetty-http-10.0.18.jar |
| CVE-2024-29869 | hive-exec-3.1.3.jar |
| CVE-2025-67721 | aircompressor-0.25.jar |
| CVE-2025-69228 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2025-4565 | protobuf-4.24.4-cp37-abi3-manylinux2014_x86_64.whl |
| CVE-2025-69229 | aiohttp-3.8.6-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
Base branch total remaining vulnerabilities: 374
Base branch commit: null
Total libraries scanned: 1981
Scan token: 4e21875a49034c01aee2d84b37cf7b7d