{"items":[{"id":"CVE-2026-59324","published":"2026-08-27T18:04:51.595Z","updated":"2026-08-28T22:46:33.636Z","title":"fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction","severity":"HIGH","score":8.2,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-59322","published":"2026-08-27T18:04:50.137Z","updated":"2026-08-28T22:46:40.016Z","title":"EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders","severity":"MEDIUM","score":6.3,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-59321","published":"2026-08-27T18:04:49.035Z","updated":"2026-08-28T22:46:47.321Z","title":"Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check","severity":"MEDIUM","score":4.2,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-59320","published":"2026-08-27T18:04:47.999Z","updated":"2026-08-28T22:46:54.662Z","title":"In Spring AMQP the link credit never replenished on listener exception path","severity":"MEDIUM","score":6.5,"vendor":"Spring","product":"Spring AMQP","kev":false,"epss":0.0042,"kevAdded":null},{"id":"CVE-2026-59319","published":"2026-08-27T18:04:46.944Z","updated":"2026-08-28T22:47:00.784Z","title":"RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure","severity":"MEDIUM","score":4.3,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-59317","published":"2026-08-27T18:04:46.006Z","updated":"2026-08-28T22:47:09.357Z","title":"In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop","severity":"MEDIUM","score":6.5,"vendor":"Spring","product":"Spring for Apache Kafka","kev":false,"epss":0.0042,"kevAdded":null},{"id":"CVE-2026-59316","published":"2026-08-27T18:04:44.963Z","updated":"2026-08-28T22:47:16.884Z","title":"Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)","severity":"HIGH","score":8.2,"vendor":"Spring","product":"Spring Authorization Server","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2026-59315","published":"2026-08-27T18:04:42.065Z","updated":"2026-08-28T22:47:23.491Z","title":"Spring Cloud Config Monitor Denial of Service","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring Cloud Config","kev":false,"epss":0.00402,"kevAdded":null},{"id":"CVE-2026-59314","published":"2026-08-27T18:04:41.062Z","updated":"2026-09-01T14:59:44.827Z","title":"Spring Framework response splitting in ContentDisposition","severity":"LOW","score":3.7,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-59311","published":"2026-08-27T18:04:40.084Z","updated":"2026-08-28T22:47:29.614Z","title":"Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation","severity":"MEDIUM","score":6.8,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2026-59306","published":"2026-08-27T18:04:39.066Z","updated":"2026-08-28T18:34:15.271Z","title":"Potential for deserialization of untrusted types in Spring Cloud Stream","severity":"LOW","score":3.1,"vendor":"Spring","product":"Spring Cloud Stream","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-59313","published":"2026-08-27T17:58:03.621Z","updated":"2026-08-28T19:59:45.069Z","title":"Server Sent Event stream corruption in Spring MVC functional web framework","severity":"CRITICAL","score":9.8,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-59307","published":"2026-08-27T17:58:02.683Z","updated":"2026-08-29T03:55:53.369Z","title":"Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference","severity":"HIGH","score":8,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-59305","published":"2026-08-27T17:58:01.756Z","updated":"2026-08-28T18:34:56.205Z","title":"Partition interceptor may be improperly added while sending message","severity":"LOW","score":3.1,"vendor":"Spring","product":"Spring Cloud Stream","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-59304","published":"2026-08-27T17:58:00.802Z","updated":"2026-08-28T22:47:36.173Z","title":"Improper caching of the original content type in Spring Cloud Stream Avro","severity":"LOW","score":3.1,"vendor":"Spring","product":"Spring Cloud Stream","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-59303","published":"2026-08-27T17:57:59.869Z","updated":"2026-08-28T22:47:44.786Z","title":"Dynamic destination cache size is not properly bound in Spring Cloud Stream","severity":"LOW","score":3.1,"vendor":"Spring","product":"Spring Cloud Stream","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-59302","published":"2026-08-27T17:57:58.899Z","updated":"2026-08-28T22:47:52.531Z","title":"Potential for logging sensitive data in Spring Cloud Stream","severity":"LOW","score":3.1,"vendor":"Spring","product":"Spring Cloud Stream","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-59301","published":"2026-08-27T17:57:57.960Z","updated":"2026-08-28T22:47:58.312Z","title":"Potential for logging sensitive data in Spring Cloud Function Azure","severity":"LOW","score":3.1,"vendor":"Spring","product":"Spring Cloud Function","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-59300","published":"2026-08-27T17:57:57.010Z","updated":"2026-08-28T22:48:05.882Z","title":"Potential for logging sensitive data in Spring Cloud Function AWS","severity":"LOW","score":3.1,"vendor":"Spring","product":"Spring Cloud Function","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-59299","published":"2026-08-27T17:57:56.024Z","updated":"2026-08-28T22:48:12.246Z","title":"Composition lookup can potentially poison base function in Spring Cloud Function","severity":"LOW","score":3.1,"vendor":"Spring","product":"Spring Cloud Function","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-59298","published":"2026-08-27T17:57:55.073Z","updated":"2026-09-01T14:59:51.550Z","title":"Potential for improper filtering of HTTP headers in Spring Cloud Function","severity":"LOW","score":3.1,"vendor":"Spring","product":"Spring Cloud Function","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-59297","published":"2026-08-27T17:57:53.989Z","updated":"2026-08-28T18:35:31.544Z","title":"Spring Cloud Function can incorrectly determine if URI is secure","severity":"LOW","score":3.1,"vendor":"Spring","product":"Spring Cloud Function","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-59294","published":"2026-08-27T17:57:52.047Z","updated":"2026-08-28T18:36:07.272Z","title":"Arbitrary File Write via Path Traversal in ResourceCacheService","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2026-59293","published":"2026-08-27T17:57:51.016Z","updated":"2026-08-28T18:36:46.105Z","title":"SMB minimum protocol dialect defaults to SMB1","severity":"MEDIUM","score":6.6,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-59292","published":"2026-08-27T17:57:50.029Z","updated":"2026-08-28T18:37:24.514Z","title":"World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)","severity":"LOW","score":3.2,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00146,"kevAdded":null},{"id":"CVE-2026-59291","published":"2026-08-27T17:57:48.943Z","updated":"2026-08-28T18:38:29.352Z","title":"Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function","severity":"LOW","score":2,"vendor":"Spring","product":"Spring Cloud Function","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2026-59289","published":"2026-08-27T17:57:47.944Z","updated":"2026-09-02T16:29:16.153Z","title":"Spring for GraphQL Denial of Service via pagination support","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring for GraphQL","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-59288","published":"2026-08-27T17:57:46.990Z","updated":"2026-09-01T15:36:35.910Z","title":"Spring for GraphQL Information Exposure in GraphiQL support","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring for GraphQL","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-59287","published":"2026-08-27T17:57:45.951Z","updated":"2026-09-02T16:33:55.633Z","title":"Spring for GraphQL WebSocket Client Denial of Service","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Spring for GraphQL","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2026-59286","published":"2026-08-27T17:57:44.958Z","updated":"2026-09-02T17:35:48.563Z","title":"Spring for GraphQL loads Untrusted Resources in GraphiQL support","severity":"HIGH","score":8.1,"vendor":"Spring","product":"Spring for GraphQL","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2026-59285","published":"2026-08-27T17:57:43.851Z","updated":"2026-09-02T18:14:59.496Z","title":"Spring for GraphQL Unsafe Deserialization in pagination support","severity":"HIGH","score":8.1,"vendor":"Spring","product":"Spring for GraphQL","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2026-59284","published":"2026-08-27T17:57:42.527Z","updated":"2026-08-28T18:32:18.345Z","title":"Spring Cloud Commons no allow list for writable env actuator endpoint","severity":"MEDIUM","score":6.6,"vendor":"Spring","product":"Spring Cloud Commons","kev":false,"epss":0.00427,"kevAdded":null},{"id":"CVE-2026-59283","published":"2026-08-27T17:57:40.065Z","updated":"2026-08-28T18:40:46.456Z","title":"Spring Framework Safety Guard Bypass via SpEL Expression Compilation","severity":"CRITICAL","score":9.1,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00546,"kevAdded":null},{"id":"CVE-2026-59282","published":"2026-08-27T17:57:38.575Z","updated":"2026-08-28T18:30:40.789Z","title":"Spring Framework Denial of Service via Unbounded List Growth in Data Binding","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-59281","published":"2026-08-27T17:57:37.157Z","updated":"2026-08-28T18:56:23.590Z","title":"Spring Framework Cross-site Scripting via EscapedErrors","severity":"MEDIUM","score":6.1,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-59277","published":"2026-08-27T17:57:36.006Z","updated":"2026-08-28T14:01:04.295Z","title":"Spring Security InetAddressMatchers Incomplete Internal Network Classification","severity":"LOW","score":3.7,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-59276","published":"2026-08-27T17:57:34.993Z","updated":"2026-08-28T14:00:41.248Z","title":"Timing Attack via Non-Constant-Time Comparison of Sensitive Values","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-59280","published":"2026-08-27T16:41:09.664Z","updated":"2026-08-27T17:42:15.735Z","title":"Spring Framework Path Traversal via Backslash in SpringTemplateLoader","severity":"MEDIUM","score":4.3,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00349,"kevAdded":null},{"id":"CVE-2026-59272","published":"2026-08-27T16:41:08.650Z","updated":"2026-08-28T03:55:35.123Z","title":"Log4j2 AmqpAppender disables TLS hostname verification by default","severity":"MEDIUM","score":6.8,"vendor":"Spring","product":"Spring AMQP","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2026-47893","published":"2026-08-27T05:21:41.124Z","updated":"2026-08-28T19:12:43.970Z","title":"Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00464,"kevAdded":null},{"id":"CVE-2026-47892","published":"2026-08-27T05:21:40.168Z","updated":"2026-08-28T19:11:09.411Z","title":"Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints","severity":"CRITICAL","score":9.8,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00529,"kevAdded":null},{"id":"CVE-2026-47891","published":"2026-08-27T05:21:39.288Z","updated":"2026-08-27T14:52:30.491Z","title":"Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder","severity":"CRITICAL","score":9.8,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2026-47890","published":"2026-08-27T05:21:38.260Z","updated":"2026-08-27T14:53:37.162Z","title":"Spring Framework Server Sent Event stream corruption while rendering fragments","severity":"CRITICAL","score":9.8,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-47889","published":"2026-08-27T05:21:37.305Z","updated":"2026-08-27T14:57:20.579Z","title":"Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00428,"kevAdded":null},{"id":"CVE-2026-47888","published":"2026-08-27T05:21:36.474Z","updated":"2026-08-27T14:58:08.080Z","title":"Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-47887","published":"2026-08-27T05:21:35.512Z","updated":"2026-08-27T14:59:08.962Z","title":"Spring Framework Open Redirect in UrlFileNameViewController","severity":"MEDIUM","score":6.1,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-47886","published":"2026-08-27T05:21:34.631Z","updated":"2026-08-27T15:00:12.222Z","title":"Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-47885","published":"2026-08-27T05:21:33.775Z","updated":"2026-08-27T15:01:09.141Z","title":"Spring Framework maxPartSize Ignored in PartEventHttpMessageReader","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-47884","published":"2026-08-27T05:21:32.920Z","updated":"2026-08-27T15:03:29.767Z","title":"Spring Framework Improper Path Limitation in XsltView","severity":"CRITICAL","score":9.8,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00605,"kevAdded":null},{"id":"CVE-2026-47883","published":"2026-08-27T05:21:32.084Z","updated":"2026-08-27T15:02:25.563Z","title":"Spring Framework Open Redirect in UrlHandlerFilter","severity":"MEDIUM","score":6.1,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-59278","published":"2026-08-27T05:20:36.841Z","updated":"2026-08-27T12:37:42.585Z","title":"In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages","severity":"MEDIUM","score":6.5,"vendor":"Spring","product":"Spring for Apache Kafka","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-59275","published":"2026-08-27T05:20:36.022Z","updated":"2026-08-28T03:55:28.836Z","title":"Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)","severity":"MEDIUM","score":6.6,"vendor":"Spring","product":"Spring AMQP","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2026-59274","published":"2026-08-27T05:20:35.041Z","updated":"2026-08-27T14:13:56.857Z","title":"Unbounded decompression in UnZipTransformer enables zip-bomb DoS","severity":"MEDIUM","score":6.5,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.0042,"kevAdded":null},{"id":"CVE-2026-59271","published":"2026-08-27T05:20:34.133Z","updated":"2026-08-27T14:15:39.893Z","title":"Admin password disclosed in BrokerNotAliveException message","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring AMQP","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2026-59270","published":"2026-08-27T05:20:33.210Z","updated":"2026-08-28T16:52:28.234Z","title":"Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces","severity":"CRITICAL","score":9.4,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2026-47894","published":"2026-08-27T05:20:32.282Z","updated":"2026-08-27T14:18:07.039Z","title":"Spring Cloud Config Server Native Environment Repository Exposure","severity":"MEDIUM","score":4.9,"vendor":"Spring","product":"Spring Cloud Config","kev":false,"epss":0.00486,"kevAdded":null},{"id":"CVE-2026-47881","published":"2026-08-27T05:20:26.323Z","updated":"2026-08-27T14:21:14.631Z","title":"Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Spring Batch","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-47880","published":"2026-08-27T05:20:25.359Z","updated":"2026-08-27T15:06:37.711Z","title":"DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names","severity":"MEDIUM","score":5.4,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2026-47879","published":"2026-08-27T05:20:24.412Z","updated":"2026-08-27T14:28:03.681Z","title":"Spring Cloud Gateway SSRF and native file access with gRPC","severity":"HIGH","score":7.7,"vendor":"Spring","product":"Spring Cloud Gateway","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2026-47878","published":"2026-08-27T05:20:23.462Z","updated":"2026-08-27T14:32:28.405Z","title":"Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist","severity":"MEDIUM","score":5.6,"vendor":"Spring","product":"Spring Batch","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-47877","published":"2026-08-27T05:20:22.523Z","updated":"2026-08-27T14:43:11.105Z","title":"Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)","severity":"HIGH","score":8.2,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-47875","published":"2026-08-27T05:20:21.578Z","updated":"2026-08-28T16:52:00.046Z","title":"JobParameterDeserializer bypasses the trusted-type allowlist","severity":"MEDIUM","score":5.6,"vendor":"Spring","product":"Spring Batch","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-47864","published":"2026-08-27T05:06:24.914Z","updated":"2026-08-28T16:51:52.633Z","title":"Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution","severity":"MEDIUM","score":6.4,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.05914,"kevAdded":null},{"id":"CVE-2026-47849","published":"2026-08-27T05:06:23.970Z","updated":"2026-08-27T13:04:25.615Z","title":"Spring Data REST allows mutation of identifier and version properties via JSON Patch","severity":"HIGH","score":7.1,"vendor":"Spring","product":"Spring Data REST","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2026-47874","published":"2026-08-26T23:49:26.907Z","updated":"2026-08-27T13:12:29.108Z","title":"Reactor Netty HTTP Server Denial of Service With Pipelined Requests","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Reactor Netty","kev":false,"epss":0.00402,"kevAdded":null},{"id":"CVE-2026-47861","published":"2026-08-26T23:49:25.980Z","updated":"2026-08-27T13:14:00.079Z","title":"UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false","severity":"MEDIUM","score":6.3,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2026-47863","published":"2026-08-26T23:28:48.599Z","updated":"2026-08-27T14:45:41.473Z","title":"Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Reactor Core","kev":false,"epss":0.00405,"kevAdded":null},{"id":"CVE-2026-47862","published":"2026-08-26T23:28:47.655Z","updated":"2026-08-27T14:47:11.989Z","title":"ZipTransformer uses file_name header to build workDirectory path without sanitization","severity":"MEDIUM","score":5.4,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2026-47860","published":"2026-08-26T23:28:46.607Z","updated":"2026-08-27T14:48:04.818Z","title":"Unbounded decompression of attacker-supplied compressed message bodies","severity":"MEDIUM","score":6.5,"vendor":"Spring","product":"Spring AMQP","kev":false,"epss":0.0042,"kevAdded":null},{"id":"CVE-2026-47859","published":"2026-08-26T23:28:45.659Z","updated":"2026-08-27T14:48:52.190Z","title":"Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS","severity":"MEDIUM","score":5.4,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-47857","published":"2026-08-26T23:28:44.743Z","updated":"2026-08-27T15:07:38.775Z","title":"Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Reactor Core","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2026-47856","published":"2026-08-26T23:28:43.829Z","updated":"2026-08-27T15:12:42.355Z","title":"JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list","severity":"MEDIUM","score":6.3,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-47852","published":"2026-08-26T23:28:42.767Z","updated":"2026-08-27T15:13:55.925Z","title":"Predictable cache directory location allows local ONNX model substitution in Spring AI","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.00347,"kevAdded":null},{"id":"CVE-2026-47851","published":"2026-08-26T23:28:41.732Z","updated":"2026-08-27T15:14:42.087Z","title":"Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-47850","published":"2026-08-26T23:28:40.729Z","updated":"2026-08-27T15:15:43.277Z","title":"Spring Data REST allows mutation of the version property of immutable aggregates via PUT","severity":"MEDIUM","score":4.3,"vendor":"Spring","product":"Spring Data REST","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2026-47845","published":"2026-08-26T23:28:39.360Z","updated":"2026-08-27T14:02:35.899Z","title":"Reactor Netty HTTP Server may incorrectly evaluate proxy addresses","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Reactor Netty","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-47848","published":"2026-08-26T19:22:26.712Z","updated":"2026-08-26T19:44:38.993Z","title":"Reactor Netty WebSocket Client Leaks Credentials On Redirect","severity":"MEDIUM","score":6.1,"vendor":"Spring","product":"Reactor Netty","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-47844","published":"2026-08-26T19:22:25.677Z","updated":"2026-08-26T19:44:53.514Z","title":"Reactor Netty HTTP Server Leaks Exception Details","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Reactor Netty","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2026-47843","published":"2026-08-26T19:22:24.697Z","updated":"2026-08-26T19:45:10.489Z","title":"Reactor Netty may incorrectly route traffic due to DNS resolver reuse","severity":"LOW","score":3.7,"vendor":"Spring","product":"Reactor Netty","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2026-47842","published":"2026-08-26T19:22:23.745Z","updated":"2026-08-26T19:45:25.424Z","title":"Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation","severity":"MEDIUM","score":6.5,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2026-47834","published":"2026-08-26T19:22:22.873Z","updated":"2026-08-26T19:45:40.524Z","title":"Spring Data JPA Sort expression validation bypass","severity":"MEDIUM","score":4.8,"vendor":"Spring","product":"Spring Data JPA","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-47841","published":"2026-08-26T17:08:52.788Z","updated":"2026-08-27T03:58:22.127Z","title":"WebAuthn User Verification Bypass via Session Serialization","severity":"HIGH","score":7.4,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2026-47837","published":"2026-08-26T17:08:51.832Z","updated":"2026-08-26T18:50:49.428Z","title":"Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests","severity":"MEDIUM","score":6.8,"vendor":"Spring","product":"Spring Cloud Config","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-47836","published":"2026-08-26T17:05:21.979Z","updated":"2026-08-27T03:58:24.390Z","title":"Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN","severity":"HIGH","score":7.2,"vendor":"Spring","product":"Spring Cloud Config","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-41707","published":"2026-08-25T22:34:30.570Z","updated":"2026-08-27T03:57:13.462Z","title":"Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay","severity":"HIGH","score":7.4,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2026-59295","published":"2026-08-24T10:10:06.302Z","updated":"2026-08-27T17:57:52.554Z","title":"Micrometer instrumentation of Apache HttpAsyncClient DoS vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Micrometer","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2026-59318","published":"2026-08-21T12:07:10.349Z","updated":"2026-08-22T03:55:38.874Z","title":"DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection","severity":"MEDIUM","score":6.5,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-59308","published":"2026-08-21T12:07:07.992Z","updated":"2026-08-21T14:29:06.814Z","title":"Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation","severity":"MEDIUM","score":4.2,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-59279","published":"2026-08-21T12:07:05.567Z","updated":"2026-08-21T14:28:41.415Z","title":"Unbounded persistent session allocation via repeated initialize requests","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.00549,"kevAdded":null},{"id":"CVE-2026-59296","published":"2026-08-21T10:47:25.384Z","updated":"2026-08-27T17:57:53.054Z","title":"Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Micrometer","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-59323","published":"2026-08-21T10:01:05.831Z","updated":"2026-08-27T18:04:50.627Z","title":"Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Micrometer Tracing","kev":false,"epss":0.00402,"kevAdded":null},{"id":"CVE-2026-59326","published":"2026-07-30T05:34:08.304Z","updated":"2026-07-30T13:37:06.802Z","title":"HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server","severity":"LOW","score":3.3,"vendor":"Spring","product":"Spring Tools for Eclipse","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-59328","published":"2026-07-30T05:29:20.996Z","updated":"2026-07-30T13:45:05.145Z","title":"Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips","severity":"MEDIUM","score":4.2,"vendor":"Spring","product":"Spring Tools for Eclipse","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-59327","published":"2026-07-30T05:29:20.138Z","updated":"2026-07-30T13:43:41.610Z","title":"Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations","severity":"MEDIUM","score":4.4,"vendor":"Spring","product":"Spring Tools for Eclipse","kev":false,"epss":0.00105,"kevAdded":null},{"id":"CVE-2026-47882","published":"2026-07-30T05:26:07.335Z","updated":"2026-08-01T03:56:08.233Z","title":"Spring Boot DevTools remote secret generated with a non-cryptographic PRNG","severity":"HIGH","score":8.3,"vendor":"Spring","product":"Spring Tools for Eclipse","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-47873","published":"2026-07-30T05:23:59.651Z","updated":"2026-08-01T03:56:09.351Z","title":"Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces","severity":"HIGH","score":8,"vendor":"Spring","product":"Spring Tools for Eclipse","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2026-47858","published":"2026-07-30T05:15:31.292Z","updated":"2026-08-01T03:56:10.532Z","title":"live information startup mode is vulnerable for remote code execution","severity":"HIGH","score":8,"vendor":"Spring","product":"Spring Tools for Eclipse","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2026-41862","published":"2026-06-23T20:59:02.378Z","updated":"2026-06-24T15:24:46.354Z","title":"Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a…","severity":"HIGH","score":8.8,"vendor":"Spring","product":"Spring Statemachine","kev":false,"epss":0.00762,"kevAdded":null},{"id":"CVE-2026-47825","published":"2026-06-15T19:34:29.601Z","updated":"2026-06-23T19:55:27.065Z","title":"Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations","severity":"HIGH","score":8.6,"vendor":"Spring","product":"Spring Cloud Gateway","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-41708","published":"2026-06-15T18:54:42.292Z","updated":"2026-06-15T20:06:25.691Z","title":"Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Cloud Sleuth","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-47835","published":"2026-06-15T18:54:19.841Z","updated":"2026-06-15T20:06:56.646Z","title":"Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores","severity":"HIGH","score":8.6,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-41856","published":"2026-06-11T05:05:00.491Z","updated":"2026-06-30T21:52:23.654Z","title":"Spring GraphQL Annotation Detection Vulnerability","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring for GraphQL","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-41700","published":"2026-06-11T05:04:47.722Z","updated":"2026-06-30T21:51:38.214Z","title":"Cross-Site WebSocket Hijacking in Spring for GraphQL","severity":"HIGH","score":8.1,"vendor":"Spring","product":"Spring for GraphQL","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2026-41699","published":"2026-06-11T05:04:43.290Z","updated":"2026-06-30T21:51:09.488Z","title":"Unsafe Deserialization in Spring GraphQL","severity":"HIGH","score":8.1,"vendor":"Spring","product":"Spring for GraphQL","kev":false,"epss":0.00431,"kevAdded":null},{"id":"CVE-2026-41001","published":"2026-06-11T05:04:28.663Z","updated":"2026-06-23T19:54:20.854Z","title":"Predictable Temp Directory in Artemis Auto-configuration","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring Boot","kev":false,"epss":0.00094,"kevAdded":null},{"id":"CVE-2026-41000","published":"2026-06-11T05:04:24.413Z","updated":"2026-06-23T19:53:11.880Z","title":"WSS4J validation does not use configured replay cache","severity":"LOW","score":3.7,"vendor":"Spring","product":"Spring Web Services","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2026-40999","published":"2026-06-11T05:04:17.009Z","updated":"2026-06-23T19:52:42.934Z","title":"Spring WS SSRF via unvalidated WS-Addressing reply destinations","severity":"HIGH","score":8.6,"vendor":"Spring","product":"Spring Web Services","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-40998","published":"2026-06-11T05:04:12.565Z","updated":"2026-06-23T19:51:18.888Z","title":"Jaxp13 XPath XXE via StreamSource and SAXSource","severity":"HIGH","score":8.2,"vendor":"Spring","product":"Spring Web Services","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-40997","published":"2026-06-11T05:04:08.960Z","updated":"2026-06-23T19:50:52.691Z","title":"SOAP security faults leak Spring Security account state","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring Web Services","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-40996","published":"2026-06-11T05:04:05.227Z","updated":"2026-06-23T19:48:50.570Z","title":"Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default","severity":"MEDIUM","score":4.8,"vendor":"Spring","product":"Spring Web Services","kev":false,"epss":0.00129,"kevAdded":null},{"id":"CVE-2026-40995","published":"2026-06-11T05:04:01.695Z","updated":"2026-06-23T19:48:20.837Z","title":"X.509 authentication bypasses Spring Security account checks","severity":"MEDIUM","score":5.4,"vendor":"Spring","product":"Spring Web Services","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2026-40994","published":"2026-06-11T05:03:57.827Z","updated":"2026-06-23T19:47:37.845Z","title":"Wss4jSecurityInterceptor disables WS-I BSP validation by default","severity":"HIGH","score":8.2,"vendor":"Spring","product":"Spring Web Services","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-40992","published":"2026-06-11T05:03:53.539Z","updated":"2026-06-23T19:46:36.493Z","title":"Mail Auto-Configuration Does Not Enable SSL Hostname Verification","severity":"MEDIUM","score":5,"vendor":"Spring","product":"Spring Boot","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-40987","published":"2026-06-11T05:03:32.606Z","updated":"2026-06-23T19:45:07.463Z","title":"Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization","severity":"HIGH","score":7.1,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2026-40986","published":"2026-06-11T05:03:26.458Z","updated":"2026-06-23T19:42:23.692Z","title":"Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML","severity":"MEDIUM","score":4.8,"vendor":"Spring","product":"Spring Web Flow","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-40985","published":"2026-06-11T05:02:53.887Z","updated":"2026-06-23T19:09:40.302Z","title":"Data Binding Vulnerability in Spring Web Flow with Unified EL Parser","severity":"MEDIUM","score":6.4,"vendor":"Spring","product":"Spring Web Flow","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-47838","published":"2026-06-09T23:50:07.988Z","updated":"2026-06-30T21:49:56.180Z","title":"Unauthorized User Impersonation when Using X.509 Client Certificates","severity":"MEDIUM","score":6.8,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-41837","published":"2026-06-09T23:49:49.848Z","updated":"2026-06-30T21:47:41.946Z","title":"Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring Data REST","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-41732","published":"2026-06-09T23:49:31.164Z","updated":"2026-06-27T21:17:35.895Z","title":"In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization","severity":"HIGH","score":8.1,"vendor":"Spring","product":"Spring for Apache Pulsar","kev":false,"epss":0.00347,"kevAdded":null},{"id":"CVE-2026-41731","published":"2026-06-09T23:49:26.535Z","updated":"2026-08-05T12:14:45.446Z","title":"In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization","severity":"HIGH","score":8.1,"vendor":"Spring","product":"Spring for Apache Kafka","kev":false,"epss":0.0051,"kevAdded":null},{"id":"CVE-2026-41730","published":"2026-06-09T23:49:21.572Z","updated":"2026-06-30T21:47:00.115Z","title":"Spring Data REST exposes persistence-layer internals in error responses","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring Data REST","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-41729","published":"2026-06-09T23:49:17.014Z","updated":"2026-06-11T03:55:37.180Z","title":"Spring Data REST SpEL Injection via Map Key in JSON Patch","severity":"HIGH","score":8.1,"vendor":"Spring","product":"Spring Data REST","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2026-41728","published":"2026-06-09T23:49:13.279Z","updated":"2026-06-30T21:44:46.345Z","title":"Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Data REST","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2026-41727","published":"2026-06-09T23:49:10.215Z","updated":"2026-06-27T21:15:43.681Z","title":"In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior","severity":"MEDIUM","score":6.5,"vendor":"Spring","product":"Spring for Apache Kafka","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-41726","published":"2026-06-09T23:48:51.048Z","updated":"2026-06-27T21:14:56.775Z","title":"In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header","severity":"MEDIUM","score":6.5,"vendor":"Spring","product":"Spring for Apache Kafka","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2026-41721","published":"2026-06-09T23:48:47.132Z","updated":"2026-06-30T21:43:34.945Z","title":"Spring Data Commons Denial of Service via Data Binding","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Spring Data Commons","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2026-41719","published":"2026-06-09T23:48:42.396Z","updated":"2026-06-30T21:42:20.148Z","title":"Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator","severity":"MEDIUM","score":6.4,"vendor":"Spring","product":"Spring Data KeyValue","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-41717","published":"2026-06-09T23:48:38.290Z","updated":"2026-06-30T21:40:40.621Z","title":"Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding","severity":"HIGH","score":8.1,"vendor":"Spring","product":"Spring Data MongoDB","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-41716","published":"2026-06-09T23:48:20.282Z","updated":"2026-06-30T21:39:45.337Z","title":"Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Data Commons","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2026-41714","published":"2026-06-09T23:48:16.317Z","updated":"2026-06-27T21:14:02.581Z","title":"In Spring AMQP the RabbitConnectionFactoryBean.setUri(\"amqps://...\") bypasses secure SSL setup, uses TrustEverythingTrustManager","severity":"MEDIUM","score":4,"vendor":"Spring","product":"Spring AMQP","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-41711","published":"2026-06-09T23:48:12.215Z","updated":"2026-06-27T21:34:42.920Z","title":"Potential Denial of Service through crafted Sort Parameters","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Spring Data Commons","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-41706","published":"2026-06-09T23:47:58.903Z","updated":"2026-06-27T21:27:02.537Z","title":"Open Redirect When Using CookieRequestCache","severity":"MEDIUM","score":6.1,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-41701","published":"2026-06-09T23:47:54.996Z","updated":"2026-06-23T20:48:22.061Z","title":"In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues","severity":"MEDIUM","score":4.4,"vendor":"Spring","product":"Spring AMQP","kev":false,"epss":0.00173,"kevAdded":null},{"id":"CVE-2026-41697","published":"2026-06-09T23:47:42.091Z","updated":"2026-06-27T21:33:25.580Z","title":"Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern","severity":"MEDIUM","score":4.8,"vendor":"Spring","product":"Spring Data Relational","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-41696","published":"2026-06-09T23:47:37.883Z","updated":"2026-06-10T17:53:14.235Z","title":"Spring Data MongoDB Bind Parameter Literal Quoting Breakout","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Spring Data MongoDB","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2026-41695","published":"2026-06-09T23:47:33.927Z","updated":"2026-06-27T21:31:50.685Z","title":"Denial of Service in Spring Data Commons Property Path Resolution","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Data Commons","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2026-41694","published":"2026-06-09T23:47:17.784Z","updated":"2026-06-27T21:25:20.803Z","title":"SAML Payloads Decrypted Without Valid Signature","severity":"LOW","score":3.7,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2026-41008","published":"2026-06-09T23:47:07.292Z","updated":"2026-06-27T21:30:17.016Z","title":"Spring Security Authorization Server Open Redirect via request_uri","severity":"MEDIUM","score":6.1,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-41003","published":"2026-06-09T23:46:53.683Z","updated":"2026-06-27T21:24:40.807Z","title":"Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting","severity":"HIGH","score":7.6,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-40993","published":"2026-06-09T23:46:39.702Z","updated":"2026-06-27T21:23:25.462Z","title":"Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry","severity":"HIGH","score":7.3,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-40991","published":"2026-06-09T23:46:33.676Z","updated":"2026-06-27T21:10:14.865Z","title":"XML External Entity (XXE) injection when documenting untrusted XML content","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Spring REST Docs","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2026-40988","published":"2026-06-09T23:46:15.589Z","updated":"2026-06-27T21:22:39.249Z","title":"Unbounded DEFLATE Inflation in SAML 2.0 Service Provider","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2026-41007","published":"2026-06-09T04:00:47.095Z","updated":"2026-06-27T21:09:10.034Z","title":"Spring HATEOAS heap exhaustion through unbounded internal caching","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring HATEOAS","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-41006","published":"2026-06-09T03:57:39.106Z","updated":"2026-06-27T21:08:31.486Z","title":"Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring HATEOAS","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-41855","published":"2026-06-09T03:51:57.287Z","updated":"2026-06-27T21:07:12.717Z","title":"Spring Framework Unsafe Deserialization via Jackson JMS Converters","severity":"HIGH","score":8.1,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-41854","published":"2026-06-09T03:51:49.021Z","updated":"2026-06-27T21:06:18.674Z","title":"Spring Framework Server-Side Request Forgery via UriComponentsBuilder","severity":"MEDIUM","score":4.2,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-41853","published":"2026-06-09T03:51:44.875Z","updated":"2026-06-27T21:04:58.496Z","title":"Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-41852","published":"2026-06-09T03:51:39.908Z","updated":"2026-06-27T21:04:27.613Z","title":"Spring Framework Arbitrary Method Invocation in SpEL Expressions","severity":"LOW","score":3.7,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-41851","published":"2026-06-09T03:51:32.074Z","updated":"2026-06-27T21:03:56.341Z","title":"Spring Framework Denial of Service via Unbounded Cache in SpEL","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2026-41850","published":"2026-06-09T03:51:22.479Z","updated":"2026-06-27T21:03:31.320Z","title":"Spring Framework Algorithmic Denial of Service via SpEL Expressions","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2026-41849","published":"2026-06-09T03:51:17.283Z","updated":"2026-06-09T13:33:03.542Z","title":"Spring Framework Denial of Service via Integer Overflow in SpEL Expressions","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2026-41848","published":"2026-06-09T03:51:12.801Z","updated":"2026-06-27T21:02:51.634Z","title":"Spring Framework Denial of Service via AntPathMatcher","severity":"LOW","score":3.7,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-41847","published":"2026-06-09T03:51:03.298Z","updated":"2026-06-09T13:33:56.075Z","title":"Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL","severity":"MEDIUM","score":4.8,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-41846","published":"2026-06-09T03:50:56.840Z","updated":"2026-06-27T21:01:53.420Z","title":"Spring Framework Cross-site Scripting via JSP Form Tags","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-41845","published":"2026-06-09T03:50:48.454Z","updated":"2026-06-27T21:01:27.349Z","title":"Spring Framework Cross-site Scripting via JavaScriptUtils","severity":"HIGH","score":7.1,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2026-41844","published":"2026-06-09T03:50:39.340Z","updated":"2026-06-27T21:00:41.259Z","title":"Spring Framework Open Redirect in Spring MVC and WebFlux","severity":"MEDIUM","score":4.2,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-41843","published":"2026-06-09T03:50:34.480Z","updated":"2026-06-27T21:00:04.236Z","title":"Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00369,"kevAdded":null},{"id":"CVE-2026-41842","published":"2026-06-09T03:50:29.899Z","updated":"2026-06-27T20:59:32.277Z","title":"Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2026-41841","published":"2026-06-09T03:50:20.843Z","updated":"2026-06-27T20:58:58.220Z","title":"Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2026-41840","published":"2026-06-09T03:50:15.174Z","updated":"2026-06-20T00:11:52.160Z","title":"Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0…","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2026-41839","published":"2026-06-09T03:49:52.381Z","updated":"2026-06-23T20:41:11.906Z","title":"Spring Framework Escalation via Session Fixation in WebFlux","severity":"MEDIUM","score":4.2,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-41838","published":"2026-06-09T03:49:15.933Z","updated":"2026-06-27T20:57:50.695Z","title":"Spring Framework Predictable Session ID in WebSocket Module","severity":"MEDIUM","score":4.8,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-41720","published":"2026-06-09T03:48:56.229Z","updated":"2026-06-23T20:47:25.024Z","title":"Authentication Bypass with Empty Password in Spring LDAP","severity":"HIGH","score":7.4,"vendor":"Spring","product":"Spring LDAP","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2026-41715","published":"2026-06-09T03:48:41.439Z","updated":"2026-06-23T20:46:09.111Z","title":"Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect","severity":"MEDIUM","score":6.1,"vendor":"Spring","product":"Reactor Netty","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2026-41710","published":"2026-06-09T03:48:15.972Z","updated":"2026-06-23T20:40:24.254Z","title":"Cache Exhaustion in Stateful Retries leads to Denial of Service","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Spring Retry","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2026-40984","published":"2026-06-09T03:47:46.447Z","updated":"2026-09-14T12:04:26.346Z","title":"Micrometer HTTP server instrumentations DoS vulnerability","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Micrometer","kev":false,"epss":0.00792,"kevAdded":null},{"id":"CVE-2026-40983","published":"2026-06-09T03:46:54.131Z","updated":"2026-09-14T12:04:32.618Z","title":"Micrometer gRPC server instrumentation DoS vulnerability","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Micrometer","kev":false,"epss":0.00631,"kevAdded":null},{"id":"CVE-2026-40990","published":"2026-06-01T17:49:16.377Z","updated":"2026-06-01T19:35:34.505Z","title":"Unbounded cache for function definitions","severity":"MEDIUM","score":5.7,"vendor":"Spring","product":"Spring Cloud Function","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-40989","published":"2026-06-01T17:49:14.102Z","updated":"2026-06-01T19:35:11.824Z","title":"Self Routing guard bypassed via function composition","severity":"MEDIUM","score":5.7,"vendor":"Spring","product":"Spring Cloud Function","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-41863","published":"2026-05-25T05:45:37.690Z","updated":"2026-05-26T14:19:10.481Z","title":"LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API","severity":"MEDIUM","score":6.5,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-41705","published":"2026-05-09T00:34:17.870Z","updated":"2026-05-11T14:38:29.738Z","title":"Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI 1.0.x:…","severity":"HIGH","score":8.6,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.00353,"kevAdded":null},{"id":"CVE-2026-40981","published":"2026-05-07T03:55:43.600Z","updated":"2026-07-15T01:00:15.193Z","title":"When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing…","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Cloud Config","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2026-41002","published":"2026-05-07T03:53:18.269Z","updated":"2026-05-09T03:55:58.649Z","title":"The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to…","severity":"HIGH","score":7.4,"vendor":"Spring","product":"Spring Cloud Config","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-41004","published":"2026-05-07T03:51:31.920Z","updated":"2026-05-07T12:56:31.413Z","title":"When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from…","severity":"MEDIUM","score":4.4,"vendor":"Spring","product":"Spring Cloud Config","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-40982","published":"2026-05-07T03:49:30.065Z","updated":"2026-07-15T01:00:13.424Z","title":"Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker,…","severity":"CRITICAL","score":9.1,"vendor":"Spring","product":"Spring Cloud Config","kev":false,"epss":0.00727,"kevAdded":null},{"id":"CVE-2026-40969","published":"2026-04-28T14:54:07.360Z","updated":"2026-04-28T17:21:36.495Z","title":"Spring gRPC AuthenticationException message reflected to remote client","severity":"LOW","score":3.7,"vendor":"Spring","product":"Spring gRPC","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-40968","published":"2026-04-28T13:42:35.525Z","updated":"2026-04-28T14:36:35.953Z","title":"Spring gRPC SecurityContext leaks across requests on authorization failure","severity":"MEDIUM","score":4.3,"vendor":"Spring","product":"Spring gRPC","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-40980","published":"2026-04-28T07:31:24.041Z","updated":"2026-04-28T12:32:40.140Z","title":"In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`.…","severity":"MEDIUM","score":6.5,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-40979","published":"2026-04-28T07:31:21.447Z","updated":"2026-04-28T12:33:07.977Z","title":"In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in…","severity":"MEDIUM","score":6.1,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.00105,"kevAdded":null},{"id":"CVE-2026-40978","published":"2026-04-28T07:18:53.774Z","updated":"2026-04-29T03:55:35.548Z","title":"SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs. Affected versions:…","severity":"HIGH","score":8.8,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-40967","published":"2026-04-28T06:03:51.857Z","updated":"2026-04-29T13:29:47.165Z","title":"In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages.…","severity":"HIGH","score":8.6,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-40977","published":"2026-04-27T23:36:06.654Z","updated":"2026-04-28T14:34:36.220Z","title":"When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the…","severity":"MEDIUM","score":4.7,"vendor":"Spring","product":"Spring Boot","kev":false,"epss":0.00112,"kevAdded":null},{"id":"CVE-2026-40976","published":"2026-04-27T23:34:51.422Z","updated":"2026-07-15T01:00:17.230Z","title":"In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable,…","severity":"CRITICAL","score":9.1,"vendor":"Spring","product":"Spring Boot","kev":false,"epss":0.00489,"kevAdded":null},{"id":"CVE-2026-40975","published":"2026-04-27T23:32:58.596Z","updated":"2026-07-15T01:00:19.147Z","title":"Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used…","severity":"MEDIUM","score":4.8,"vendor":"Spring","product":"Spring Boot","kev":false,"epss":0.00312,"kevAdded":null},{"id":"CVE-2026-40974","published":"2026-04-27T23:31:40.629Z","updated":"2026-04-28T12:41:52.250Z","title":"Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot…","severity":"MEDIUM","score":5,"vendor":"Spring","product":"Spring Boot","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-40973","published":"2026-04-27T23:29:51.946Z","updated":"2026-04-29T03:55:43.148Z","title":"A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When…","severity":"HIGH","score":7,"vendor":"Spring","product":"Spring Boot","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-40972","published":"2026-04-27T23:15:19.194Z","updated":"2026-04-29T03:55:44.263Z","title":"An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme…","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Boot","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2026-40971","published":"2026-04-27T22:45:13.327Z","updated":"2026-04-28T12:46:29.029Z","title":"When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker.…","severity":"MEDIUM","score":5,"vendor":"Spring","product":"Spring Boot","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-40970","published":"2026-04-27T19:09:58.835Z","updated":"2026-04-27T19:30:55.167Z","title":"When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the…","severity":"MEDIUM","score":5,"vendor":"Spring","product":"Spring Boot","kev":false,"epss":0.00136,"kevAdded":null},{"id":"CVE-2026-22754","published":"2026-04-22T05:32:48.172Z","updated":"2026-07-15T01:19:27.274Z","title":"ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-22753","published":"2026-04-22T05:20:31.083Z","updated":"2026-04-22T15:59:59.319Z","title":"Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-22748","published":"2026-04-22T05:15:03.505Z","updated":"2026-04-22T16:00:09.573Z","title":"Potential Security Misconfiguration when Using withIssuerLocation","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-22747","published":"2026-04-22T05:08:41.318Z","updated":"2026-07-15T01:19:29.723Z","title":"Unauthorized User Impersonation when Using X.509 Client Certificates","severity":"MEDIUM","score":6.8,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-22746","published":"2026-04-22T05:02:24.327Z","updated":"2026-04-22T13:36:42.801Z","title":"User Attribute Enumeration when Using DaoAuthenticationProvider","severity":"LOW","score":3.7,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-22751","published":"2026-04-21T18:30:35.428Z","updated":"2026-04-21T18:44:34.841Z","title":"Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions","severity":"MEDIUM","score":4.8,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-22744","published":"2026-03-27T05:38:59.633Z","updated":"2026-06-02T16:05:50.935Z","title":"In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts…","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-22743","published":"2026-03-27T05:33:20.872Z","updated":"2026-03-27T19:38:58.544Z","title":"Server-Side Request Forgery via Filter Expression Keys in Neo4jVectorStore","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-22742","published":"2026-03-27T05:27:41.165Z","updated":"2026-05-10T13:03:54.063Z","title":"Server-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL Fetching","severity":"HIGH","score":8.6,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-22738","published":"2026-03-27T05:21:07.168Z","updated":"2026-05-10T13:04:38.045Z","title":"SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution","severity":"CRITICAL","score":9.8,"vendor":"Spring","product":"Spring AI","kev":false,"epss":0.01107,"kevAdded":null},{"id":"CVE-2026-22739","published":"2026-03-24T00:16:52.794Z","updated":"2026-03-24T14:40:53.515Z","title":"Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks","severity":"HIGH","score":8.6,"vendor":"Spring","product":"Spring Cloud","kev":false,"epss":0.0122,"kevAdded":null},{"id":"CVE-2026-22737","published":"2026-03-19T23:53:59.918Z","updated":"2026-03-20T14:43:50.722Z","title":"Spring Framework Improper Path Limitation with Script View Templates","severity":"MEDIUM","score":5.9,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-22735","published":"2026-03-19T23:37:35.587Z","updated":"2026-03-20T14:44:48.043Z","title":"Server Sent Event stream corruption","severity":"LOW","score":2.6,"vendor":"Spring","product":"Spring Foundation","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-22733","published":"2026-03-19T23:29:10.098Z","updated":"2026-03-20T14:45:18.731Z","title":"Authentication Bypass under Actuator CloudFoundry endpoints","severity":"HIGH","score":8.2,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-22731","published":"2026-03-19T22:36:15.112Z","updated":"2026-03-20T15:33:43.191Z","title":"Authentication Bypass under Actuator Health groups paths","severity":"HIGH","score":8.2,"vendor":"Spring","product":"Spring Boot","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2025-22234","published":"2026-01-22T21:02:23.992Z","updated":"2026-01-22T21:27:13.558Z","title":"Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2026-22718","published":"2026-01-14T05:10:58.485Z","updated":"2026-01-14T14:19:10.368Z","title":"Command injection vulnerability","severity":"MEDIUM","score":6.8,"vendor":"Spring","product":"CLI VSCode Extension","kev":false,"epss":0.00579,"kevAdded":null},{"id":"CVE-2025-41243","published":"2025-09-16T14:54:57.396Z","updated":"2026-02-26T17:48:29.456Z","title":"Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux","severity":"CRITICAL","score":10,"vendor":"Spring","product":"Cloud Gateway","kev":false,"epss":0.03674,"kevAdded":null},{"id":"CVE-2025-41232","published":"2025-05-21T10:23:07.078Z","updated":"2026-02-26T18:28:04.260Z","title":"CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods","severity":"CRITICAL","score":9.1,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00627,"kevAdded":null},{"id":"CVE-2025-22233","published":"2025-05-16T19:14:07.500Z","updated":"2025-05-17T02:37:03.191Z","title":"Spring Framework DataBinder Case Sensitive Match Exception","severity":"LOW","score":3.1,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2025-22235","published":"2025-04-28T07:10:35.370Z","updated":"2025-05-16T23:03:06.227Z","title":"Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed","severity":"HIGH","score":7.3,"vendor":"Spring","product":"Spring Boot","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2025-22232","published":"2025-04-10T17:26:56.755Z","updated":"2025-04-10T18:08:28.560Z","title":"Spring Cloud Config Server May Not Use Vault Token Sent By Clients","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring Cloud Config","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2025-22223","published":"2025-03-24T17:42:49.634Z","updated":"2025-03-24T18:06:24.575Z","title":"Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass.…","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00506,"kevAdded":null},{"id":"CVE-2025-22228","published":"2025-03-20T05:49:19.275Z","updated":"2026-02-26T19:09:20.934Z","title":"CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length","severity":"HIGH","score":7.4,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.0061,"kevAdded":null},{"id":"CVE-2024-38829","published":"2024-12-04T21:06:05.021Z","updated":"2024-12-10T14:33:55.692Z","title":"Spring LDAP sensitive data exposure for case-sensitive comparisons","severity":"LOW","score":3.7,"vendor":"Spring","product":"Spring LDAP","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2024-38828","published":"2024-11-18T03:45:46.542Z","updated":"2025-05-09T20:03:35.921Z","title":"CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring","kev":false,"epss":0.00724,"kevAdded":null},{"id":"CVE-2024-38821","published":"2024-10-28T07:06:13.404Z","updated":"2025-01-24T20:03:04.932Z","title":"Authorization Bypass of Static Resources in WebFlux Applications","severity":"CRITICAL","score":9.1,"vendor":"Spring","product":"Spring","kev":false,"epss":0.01741,"kevAdded":null},{"id":"CVE-2024-38816","published":"2024-09-13T06:10:06.598Z","updated":"2025-03-18T15:06:29.551Z","title":"CVE-2024-38816: Path traversal vulnerability in functional web frameworks","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring","kev":false,"epss":0.21263,"kevAdded":null},{"id":"CVE-2024-38807","published":"2024-08-23T08:26:11.826Z","updated":"2025-03-27T16:36:21.258Z","title":"CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader","severity":"MEDIUM","score":6.3,"vendor":"Spring","product":"Spring Boot","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2024-38808","published":"2024-08-20T07:12:44.736Z","updated":"2024-10-30T18:41:27.943Z","title":"CVE-2024-38808: Spring Expression DoS Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.00568,"kevAdded":null},{"id":"CVE-2024-38810","published":"2024-08-20T03:35:24.795Z","updated":"2024-08-20T13:34:50.068Z","title":"Missing Authorization When Using @AuthorizeReturnObject","severity":"MEDIUM","score":6.5,"vendor":"spring","product":"spring security","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2024-37084","published":"2024-07-25T09:17:50.378Z","updated":"2024-08-02T03:43:50.987Z","title":"CVE-2024-37084: Remote code execution in Spring Cloud Data Flow","severity":"CRITICAL","score":9.8,"vendor":"Spring","product":"Spring Cloud Data Flow","kev":false,"epss":0.35211,"kevAdded":null},{"id":"CVE-2024-22262","published":"2024-04-16T05:54:12.786Z","updated":"2025-02-13T17:33:40.239Z","title":"CVE-2024-22262: Spring Framework URL Parsing with Host Validation","severity":"HIGH","score":8.1,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.01191,"kevAdded":null},{"id":"CVE-2024-22258","published":"2024-03-20T03:58:13.125Z","updated":"2024-12-05T20:31:25.882Z","title":"CVE-2024-22258: PKCE Downgrade in Spring Authorization Server","severity":"MEDIUM","score":6.1,"vendor":"Spring","product":"Spring","kev":false,"epss":0.00526,"kevAdded":null},{"id":"CVE-2024-22259","published":"2024-03-16T04:40:08.680Z","updated":"2025-02-13T17:33:39.598Z","title":"CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)","severity":"HIGH","score":8.1,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.02573,"kevAdded":null},{"id":"CVE-2024-22243","published":"2024-02-23T05:03:54.426Z","updated":"2025-02-13T17:33:38.355Z","title":"CVE-2024-22243: Spring Framework URL Parsing with Host Validation","severity":"HIGH","score":8.1,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.03967,"kevAdded":null},{"id":"CVE-2024-22234","published":"2024-02-20T07:02:50.873Z","updated":"2025-02-13T17:33:37.468Z","title":"CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated","severity":"HIGH","score":7.4,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.00682,"kevAdded":null},{"id":"CVE-2024-22236","published":"2024-01-31T06:54:51.091Z","updated":"2025-06-03T18:43:58.133Z","title":"In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to…","severity":"LOW","score":3.3,"vendor":"Spring","product":"Spring Cloud Contract","kev":false,"epss":0.00223,"kevAdded":null},{"id":"CVE-2024-22233","published":"2024-01-22T12:16:15.223Z","updated":"2025-06-20T18:41:29.445Z","title":"CVE-2024-22233: Spring Framework server Web DoS Vulnerability","severity":"HIGH","score":7.5,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.01048,"kevAdded":null},{"id":"CVE-2023-34055","published":"2023-11-28T08:27:25.132Z","updated":"2025-02-13T16:55:15.158Z","title":"Spring Boot server Web Observations DoS Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring Boot","kev":false,"epss":0.01219,"kevAdded":null},{"id":"CVE-2023-34054","published":"2023-11-28T08:16:14.361Z","updated":"2024-08-02T16:01:52.415Z","title":"Reactor Netty HTTP Server Metrics DoS Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Reactor Netty","kev":false,"epss":0.00914,"kevAdded":null},{"id":"CVE-2023-34053","published":"2023-11-28T08:10:37.217Z","updated":"2025-02-13T16:55:14.580Z","title":"Spring Framework server Web Observations DoS Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.01159,"kevAdded":null},{"id":"CVE-2023-34050","published":"2023-10-19T07:11:35.038Z","updated":"2024-09-12T17:58:46.718Z","title":"Spring AMQP Deserialization Vulnerability","severity":"MEDIUM","score":5,"vendor":"Spring","product":"Spring AMQP","kev":false,"epss":0.01841,"kevAdded":null},{"id":"CVE-2023-34047","published":"2023-09-20T09:09:12.648Z","updated":"2024-09-24T19:04:05.232Z","title":"Exposure of data and identity to wrong session in Spring for GraphQL","severity":"LOW","score":3.1,"vendor":"Spring","product":"Spring for GraphQL","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2023-34040","published":"2023-08-24T12:59:20.620Z","updated":"2024-10-01T16:13:52.394Z","title":"Java Deserialization vulnerability in Spring-Kafka When Improperly Configured","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring For Apache Kafka","kev":false,"epss":0.0209,"kevAdded":null},{"id":"CVE-2023-34036","published":"2023-07-17T10:00:43.245Z","updated":"2024-10-30T14:52:30.766Z","title":"Forwarded header exploit with Spring HATEOAS on WebFlux","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring HATEOAS","kev":false,"epss":0.00475,"kevAdded":null},{"id":"CVE-2020-5397","published":"2020-01-17T18:50:12.742Z","updated":"2024-09-17T01:45:35.621Z","title":"CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux","severity":"MEDIUM","score":5.3,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.02551,"kevAdded":null},{"id":"CVE-2020-5398","published":"2020-01-16T23:55:15.596Z","updated":"2026-10-08T21:13:59.625Z","title":"RFD Attack via \"Content-Disposition\"  Header Sourced from Request Input by Spring MVC or Spring WebFlux Application","severity":"HIGH","score":8,"vendor":"Spring","product":"Spring Framework","kev":false,"epss":0.88322,"kevAdded":null},{"id":"CVE-2019-11272","published":"2019-06-26T14:06:15.312Z","updated":"2024-09-16T19:25:59.208Z","title":"PlaintextPasswordEncoder authenticates encoded passwords that are null","severity":"HIGH","score":7.3,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.01382,"kevAdded":null},{"id":"CVE-2019-11269","published":"2019-06-12T14:46:18.601Z","updated":"2024-09-16T23:11:41.537Z","title":"Open Redirector in spring-security-oauth2","severity":"MEDIUM","score":4.2,"vendor":"Spring","product":"Spring Security OAuth","kev":false,"epss":0.08906,"kevAdded":null},{"id":"CVE-2019-3802","published":"2019-06-03T13:47:42.791Z","updated":"2024-09-17T00:22:02.219Z","title":"Additional information exposure with Spring Data JPA example matcher","severity":"LOW","score":3.5,"vendor":"Spring","product":"Spring Data JPA","kev":false,"epss":0.01247,"kevAdded":null},{"id":"CVE-2019-3799","published":"2019-05-06T15:21:37.135Z","updated":"2024-09-17T00:16:21.820Z","title":"Directory Traversal with spring-cloud-config-server","severity":"MEDIUM","score":6.5,"vendor":"Spring","product":"Spring Cloud Config","kev":false,"epss":0.85295,"kevAdded":null},{"id":"CVE-2019-3797","published":"2019-05-06T15:21:37.081Z","updated":"2024-09-16T17:33:03.727Z","title":"Additional information exposure with Spring Data JPA derived queries","severity":"LOW","score":3.5,"vendor":"Spring","product":"Spring Boot","kev":false,"epss":0.01087,"kevAdded":null},{"id":"CVE-2019-3795","published":"2019-04-09T15:29:02.127Z","updated":"2024-09-17T00:02:03.823Z","title":"Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security","severity":"LOW","score":3.8,"vendor":"Spring","product":"Spring Security","kev":false,"epss":0.01921,"kevAdded":null},{"id":"CVE-2019-3778","published":"2019-03-07T19:00:00.000Z","updated":"2024-09-16T20:57:23.699Z","title":"Open Redirect in spring-security-oauth2","severity":"MEDIUM","score":6.5,"vendor":"Spring","product":"Spring Security OAuth","kev":false,"epss":0.16596,"kevAdded":null},{"id":"CVE-2019-3774","published":"2019-01-18T22:00:00.000Z","updated":"2024-09-16T20:57:23.130Z","title":"Spring Batch XML External Entity Injection (XXE)","severity":"CRITICAL","score":9.8,"vendor":"Spring","product":"Spring Batch","kev":false,"epss":0.03057,"kevAdded":null},{"id":"CVE-2019-3773","published":"2019-01-18T22:00:00.000Z","updated":"2024-09-17T03:33:35.558Z","title":"Spring Web Services XML External Entity Injection (XXE)","severity":"CRITICAL","score":9.8,"vendor":"Spring","product":"Spring Web Services","kev":false,"epss":0.04144,"kevAdded":null},{"id":"CVE-2019-3772","published":"2019-01-18T22:00:00.000Z","updated":"2024-09-16T16:23:25.840Z","title":"Spring Integration XML External Entity Injection (XXE)","severity":"CRITICAL","score":9.8,"vendor":"Spring","product":"Spring Integration","kev":false,"epss":0.03002,"kevAdded":null}]}