The core engine has a spring-beans dependency which is used for bootstrapping the engine via camunda.cfg.xml. It currently uses Spring 3, which is out of support for a long time already and has several known vulnerabilities. While the engine can be safely used with Spring 4 and Spring 5 already, by default we pull in an unsafe dependency which then e.g. shows up in vulenerability report tools.