Vulnerabilities fixed in Semaphore 5.10.4
- Last Updated: July 24, 2026
- 1 minute read
- Semaphore
- Documentation
The following table lists the vulnerabilities resolved in Semaphore 5.10.4. You can filter the table by vulnerability or component. Note that some vulnerabilities have multiple IDs.
| Vulnerability ID | Component |
|---|---|
| BDSA-2026-3137/CVE-2026-28208 | Java UnRar |
| BDSA-2026-3557/CVE-2026-24281 | Apache ZooKeeper |
| BDSA-2026-3559/CVE-2026-24308 | Apache ZooKeeper |
| BDSA-2026-3678/CVE-2026-23907 | Apache PDFBox |
| BDSA-2026-3881/CVE-2026-1526 | undici |
| BDSA-2026-3887/CVE-2026-1525 | undici |
| BDSA-2026-3899/CVE-2026-2229 | undici |
| BDSA-2026-3905/CVE-2026-1527 | undici |
| BDSA-2026-3909/CVE-2026-1528 | undici |
| BDSA-2026-4055/CVE-2026-32141 | flatted |
| BDSA-2026-4873/CVE-2026-22737 | Spring Framework |
| BDSA-2026-4886/CVE-2026-22735 | Spring Framework |
| BDSA-2026-5632/CVE-2026-33750 | brace-expansion |
| BDSA-2026-5635/CVE-2026-33671 | picomatch |
| BDSA-2026-5636/CVE-2026-33672 | picomatch |
| BDSA-2026-5638/CVE-2026-4926 | path-to-regexp |
| BDSA-2026-5639/CVE-2026-4923 | path-to-regexp |
| BDSA-2026-5656/CVE-2026-33870 | Netty Project |
| BDSA-2026-5659/CVE-2026-33871 | Netty Project |
| BDSA-2026-6064/CVE-2026-2950 | Lodash, lodash-es |
| BDSA-2026-6606 | jackson-core |
| BDSA-2026-6680/CVE-2026-39865 | axios |
| BDSA-2026-6683/CVE-2026-5795 | Jetty |
| BDSA-2026-6871/CVE-2026-34477 | Apache Log4j |
| BDSA-2026-6874/CVE-2026-34478 | Apache Log4j |
| BDSA-2026-6896/CVE-2026-34479 | Apache Log4j |
| BDSA-2026-6938/CVE-2026-34480 | Apache Log4j |
| BDSA-2026-7157/CVE-2026-2332 | Jetty |
| BDSA-2026-7212 | DOMPurify |
| BDSA-2026-7597/CVE-2026-22740 | Spring Framework |
| BDSA-2026-7607/CVE-2026-22745 | Spring Framework |
| BDSA-2026-7696/CVE-2026-41245 | Java UnRar |
| BDSA-2026-8016/CVE-2026-41239 | DOMPurify |
| BDSA-2026-8017/CVE-2026-41238 | DOMPurify |
| BDSA-2026-8018/CVE-2026-41240 | DOMPurify |
| BDSA-2026-8026/CVE-2026-41988 | uuid |
| BDSA-2026-8333/CVE-2026-42033 | axios |
| BDSA-2026-8341/CVE-2026-42037 | axios |
| BDSA-2026-8347/CVE-2026-42038 | axios |
| BDSA-2026-8349/CVE-2026-42034 | axios |
| BDSA-2026-8362/CVE-2026-42035 | axios |
| BDSA-2026-8364/CVE-2026-42039 | axios |
| BDSA-2026-8366/CVE-2026-42036 | axios |
| BDSA-2026-8368/CVE-2026-42042 | axios |
| BDSA-2026-8370/CVE-2026-42041 | axios |
| BDSA-2026-8371/CVE-2026-42044 | axios |
| BDSA-2026-8372/CVE-2026-42043 | axios |
| BDSA-2026-8458/CVE-2026-40895 | follow-redirects |
| BDSA-2026-8460/CVE-2026-41305 | PostCSS |
| BDSA-2026-8501/CVE-2026-41607 | Apache Thrift |
| BDSA-2026-8502/CVE-2026-41606 | Apache Thrift |
| BDSA-2026-8506/CVE-2025-48431 | Apache Thrift |
| BDSA-2026-8522/CVE-2026-41602 | Apache Thrift |
| BDSA-2026-9089/CVE-2026-43868 | Apache Thrift |