{"items":[{"id":"CVE-2026-59324","published":"2026-08-27T18:04:51.595Z","updated":"2026-08-28T22:46:33.636Z","title":"fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction","severity":"HIGH","score":8.2,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-59322","published":"2026-08-27T18:04:50.137Z","updated":"2026-08-28T22:46:40.016Z","title":"EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders","severity":"MEDIUM","score":6.3,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-59321","published":"2026-08-27T18:04:49.035Z","updated":"2026-08-28T22:46:47.321Z","title":"Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check","severity":"MEDIUM","score":4.2,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-59311","published":"2026-08-27T18:04:40.084Z","updated":"2026-08-28T22:47:29.614Z","title":"Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation","severity":"MEDIUM","score":6.8,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2026-59307","published":"2026-08-27T17:58:02.683Z","updated":"2026-08-29T03:55:53.369Z","title":"Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference","severity":"HIGH","score":8,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-59293","published":"2026-08-27T17:57:51.016Z","updated":"2026-08-28T18:36:46.105Z","title":"SMB minimum protocol dialect defaults to SMB1","severity":"MEDIUM","score":6.6,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-59292","published":"2026-08-27T17:57:50.029Z","updated":"2026-08-28T18:37:24.514Z","title":"World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)","severity":"LOW","score":3.2,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-59274","published":"2026-08-27T05:20:35.041Z","updated":"2026-08-27T14:13:56.857Z","title":"Unbounded decompression in UnZipTransformer enables zip-bomb DoS","severity":"MEDIUM","score":6.5,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.0042,"kevAdded":null},{"id":"CVE-2026-47880","published":"2026-08-27T05:20:25.359Z","updated":"2026-08-27T15:06:37.711Z","title":"DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names","severity":"MEDIUM","score":5.4,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2026-47864","published":"2026-08-27T05:06:24.914Z","updated":"2026-08-28T16:51:52.633Z","title":"Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution","severity":"MEDIUM","score":6.4,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.05914,"kevAdded":null},{"id":"CVE-2026-47861","published":"2026-08-26T23:49:25.980Z","updated":"2026-08-27T13:14:00.079Z","title":"UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false","severity":"MEDIUM","score":6.3,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2026-47862","published":"2026-08-26T23:28:47.655Z","updated":"2026-08-27T14:47:11.989Z","title":"ZipTransformer uses file_name header to build workDirectory path without sanitization","severity":"MEDIUM","score":5.4,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2026-47859","published":"2026-08-26T23:28:45.659Z","updated":"2026-08-27T14:48:52.190Z","title":"Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS","severity":"MEDIUM","score":5.4,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-47856","published":"2026-08-26T23:28:43.829Z","updated":"2026-08-27T15:12:42.355Z","title":"JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list","severity":"MEDIUM","score":6.3,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-40987","published":"2026-06-11T05:03:32.606Z","updated":"2026-06-23T19:45:07.463Z","title":"Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization","severity":"HIGH","score":7.1,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2019-3772","published":"2019-01-18T22:00:00.000Z","updated":"2024-09-16T16:23:25.840Z","title":"Spring Integration XML External Entity Injection (XXE)","severity":"CRITICAL","score":9.8,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.03002,"kevAdded":null}]}