{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"3.0.0","last_affected":"4.0.4"}],"component":"com.github.ulisesbocchio:jasypt-spring-boot","cve_ids":["CVE-2026-9370"],"ecosystem":"Maven","epss":0.00202,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-jgj7-c8vj-w563","id":"tcs_01M5N92WZFMJ1D86MX6PMGV2BN","modified_at":"2026-06-30T16:56:34.349037Z","published_at":"2026-05-26T13:30:32Z","references":["https://osv.dev/vulnerability/GHSA-jgj7-c8vj-w563","https://nvd.nist.gov/vuln/detail/CVE-2026-9370","https://github.com/dntyfate/cve/issues/3","https://github.com/ulisesbocchio/jasypt-spring-boot/issues/431","https://github.com/ulisesbocchio/jasypt-spring-boot","https://vuldb.com/submit/813198","https://vuldb.com/vuln/365333","https://vuldb.com/vuln/365333/cti"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-jgj7-c8vj-w563","url":"https://osv.dev/vulnerability/GHSA-jgj7-c8vj-w563"}],"summary":"jasypt-spring-boot Uses a One-Way Hash without a Salt"}