Skip to content
Spring By Vmware vulnerabilities
Newest
-
spring integration, vmware spring integration +1 more
fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
CVE-2026-59324
8.2 High
-
spring integration, vmware spring integration +1 more
EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders
CVE-2026-59322
Fix available
6.3 Medium
-
spring integration, vmware spring integration +1 more
Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check
CVE-2026-59321
4.2 Medium
-
spring integration, vmware spring integration +1 more
Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation
CVE-2026-59311
6.8 Medium
-
spring integration, vmware spring integration +1 more
Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference
CVE-2026-59307
8.0 High
-
spring integration, vmware spring integration +1 more
SMB minimum protocol dialect defaults to SMB1
CVE-2026-59293
6.6 Medium
-
spring integration, vmware spring integration +1 more
World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)
CVE-2026-59292
3.2 Low
-
spring integration, vmware spring integration +1 more
Unbounded decompression in UnZipTransformer enables zip-bomb DoS
CVE-2026-59274
6.5 Medium
-
broadcom spring batch, spring batch +1 more
Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
CVE-2026-47881
5.9 Medium
-
spring integration, vmware spring integration +1 more
DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names
CVE-2026-47880
5.4 Medium
-
broadcom spring batch, spring batch +1 more
Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
CVE-2026-47878
Fix available
5.6 Medium
-
broadcom spring batch, spring batch +1 more
JobParameterDeserializer bypasses the trusted-type allowlist
CVE-2026-47875
5.6 Medium
-
spring integration, vmware spring integration +1 more
Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
CVE-2026-47864
6.4 Medium
-
spring integration, vmware spring integration +1 more
UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false
CVE-2026-47861
Fix available
6.3 Medium
-
spring integration, vmware spring integration +1 more
ZipTransformer uses file_name header to build workDirectory path without sanitization
CVE-2026-47862
5.4 Medium
-
spring integration, vmware spring integration +1 more
Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS
CVE-2026-47859
5.4 Medium
-
spring integration, vmware spring integration +1 more
JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list
CVE-2026-47856
Fix available
6.3 Medium
-
spring integration, vmware spring integration +1 more
Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization
CVE-2026-40987
Public exploitFix available
7.1 High
-
spring by vmware cloud netflix, vmware spring cloud netflix +1 more
Code injection in spring-cloud-netflix-hystrix-dashboard
CVE-2021-22053
Public exploitFix available
EPSS 13.2%
8.8 High
-
spring by vmware cloud task, vmware spring cloud task +1 more
Possibility of SQL Injection in Spring Cloud Task Execution Sorting Query
CVE-2020-5428
Fix available
5.1 Medium
-
spring cloud data flow, vmware spring cloud data flow +1 more
Possibility of SQL Injection in Spring Cloud Data Flow Task Execution Sorting Query
CVE-2020-5427
Fix available
5.7 Medium
-
spring by vmware framework, vmware spring framework, netapp oncommand insight +36 more +38 more
RFD Protection Bypass via jsessionid
CVE-2020-5421
Public exploitFix available
EPSS 11.6%
8.7 High
-
spring by vmware cloud netflix, vmware spring cloud netflix +1 more
Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard
CVE-2020-5412
Fix available
EPSS 10.2%
6.5 Medium
-
spring by vmware integration, vmware spring integration, oracle banking corporate lending process management +6 more +8 more
Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets"
CVE-2020-5413
Fix available
9.8 Critical
-
broadcom spring batch, spring by vmware batch +1 more
Jackson Configuration Allows Code Execution with Unknown "Serialization Gadgets"
CVE-2020-5411
Fix available
8.1 High
-
spring cloud config, vmware spring cloud config, vmware tanzu spring cloud configuration (config) server +2 more
Directory Traversal with spring-cloud-config-server
CVE-2020-5410
In KEVPublic exploitFix available
EPSS 95.6%
7.5 High
-
pivotal software spring security, spring security +1 more
Dictionary attack with Spring Security queryable text encryptor
CVE-2020-5408
Fix available
6.5 Medium
-
pivotal software spring security, spring security +1 more
Signature Wrapping Vulnerability with spring-security-saml2-service-provider
CVE-2020-5407
Fix available
8.8 High
-
spring cloud config, vmware spring cloud config +1 more
Directory Traversal with spring-cloud-config-server
CVE-2020-5405
Public exploitFix available
EPSS 68.5%
6.5 Medium
-
broadcom spring batch, spring batch +1 more
Spring Batch XML External Entity Injection (XXE)
CVE-2019-3774
Fix available
9.8 Critical
-
spring integration, vmware spring integration, oracle retail customer management and segmentation foundation +2 more
Spring Integration XML External Entity Injection (XXE)
CVE-2019-3772
Fix available
9.8 Critical