There was recent talk of pulling all the libraries in Lucee to match them up against known vulns. Ortus has a gov client who helped us get a huge scan done on Lucee that tagged 161 known vulns in it's 3rd party libs I've documented them all here in a ticket https://luceeserver.atlassian.net/browse/LDEV-4279 Please make some noise to get these addressed. They are preventing us from using Lucee in DOD shops basically due to the number of unpatched vulns. Just updating EHCache will take care of most of the critical ones!

I've replied in the ticket, good news is far few are already addressed in 5.3.10

ohhhh, so no CON for lucee?