diff --git a/.trivyignore b/.trivyignore
index 2357007..c53d32f 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -1,2 +1,3 @@
 # Begründete Ausnahmen. Format pro Zeile: CVE-ID  # Grund + Datum
 # z.B.: CVE-2024-12345  # nicht ausnutzbar (Komponente ungenutzt), 2026-06-28
+CVE-2026-47884  # spring-webmvc XsltView path limitation; kein OSS-Fix für 6.2.x (nur 7.0.9 = Boot 4), XsltView im Code ungenutzt (grep -ri xslt backend/src leer). Entfernen bei Boot-4-Migration. 2026-10-08
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index 23506e7..4226e8b 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -12,7 +12,8 @@ FROM nginx:alpine@sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2
 # curl/libcurl 8.19.0-r0 -> 8.20.0-r0 (CVE-2026-5773/6276)
 # libssl3/libcrypto3 3.5.7-r0 -> 3.5.8-r0 (CVE-2026-14456, same openssl flaw patched in backend/Dockerfile)
 # libuuid 2.42.1-r0 -> 2.42.3-r1 (CVE-2026-78408/78409/78410, -76642, -53612/53613/53614)
-RUN apk upgrade --no-cache libexpat c-ares curl libssl3 libcrypto3 libuuid
+# pcre2 10.47-r1 -> 10.49-r0 (CVE-2026-86145/89157/89161/103111)
+RUN apk upgrade --no-cache libexpat c-ares curl libssl3 libcrypto3 libuuid pcre2
 COPY --from=builder /app/dist /usr/share/nginx/html
 COPY nginx-spa.conf /etc/nginx/conf.d/default.conf
 EXPOSE 80
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 483572c..5632027 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -3887,9 +3887,9 @@
       }
     },
     "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {