Skip to contentSpring vulnerabilities
Newest
- spring ai, vmware spring ai +1 moreSpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code ExecutionCVE-2026-22738Public exploitFix available9.8 Critical
- spring cloud, vmware spring cloud config +1 moreSpring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF AttacksCVE-2026-22739Fix available8.6 High
- spring framework, vmware spring framework +1 moreSpring Framework Improper Path Limitation with Script View TemplatesCVE-2026-22737Fix available5.9 Medium
- spring foundation, vmware spring framework +1 moreServer Sent Event stream corruptionCVE-2026-22735Fix available2.6 Low
- spring security, vmware spring boot +1 moreAuthentication Bypass under Actuator CloudFoundry endpointsCVE-2026-22733Fix available8.2 High
- spring security, vmware spring security +1 moreUnder Some Conditions Spring Security HTTP Headers Are not WrittenCVE-2026-22732Public exploitFix available9.1 Critical
- spring boot, vmware spring boot +1 moreAuthentication Bypass under Actuator Health groups pathsCVE-2026-22731Fix available8.2 High
- spring securitySpring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigationCVE-2025-22234Fix available5.3 Medium
- spring cli vscode extensionCommand injection vulnerabilityCVE-2026-227186.8 Medium
- spring cloud gatewaySpring Expression Language property modification using Spring Cloud Gateway Server WebFluxCVE-2025-41243Public exploitFix available10.0 Critical
- spring security, vmware spring security +1 moreCVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized typesCVE-2025-41248Fix available7.5 High
- spring securityCVE-2025-41232: Spring Security authorization bypass for method security annotations on private methodsCVE-2025-41232Fix available9.1 Critical
- spring framework, vmware spring framework +1 moreSpring Framework DataBinder Case Sensitive Match ExceptionCVE-2025-22233Fix available3.1 Low
- spring bootSpring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposedCVE-2025-22235Public exploitFix available7.3 High
- spring cloud configSpring Cloud Config Server May Not Use Vault Token Sent By ClientsCVE-2025-222325.3 Medium
- spring securitySpring Security Vulnerable to Authorization Bypass via Security AnnotationsCVE-2025-22223Public exploitFix available5.3 Medium
- spring securityCVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password lengthCVE-2025-22228Fix available7.4 High
- spring ldapSpring LDAP sensitive data exposure for case-sensitive comparisonsCVE-2024-38829Fix available3.7 Low
- spring securitySpring Security Authorization Bypass for Case Sensitive ComparisonsCVE-2024-38827Fix available4.8 Medium
- springCVE-2024-38828: DoS via Spring MVC controller method with byte[] parameterCVE-2024-38828Public exploitFix available5.3 Medium
- spring, spring webflux +1 moreAuthorization Bypass of Static Resources in WebFlux ApplicationsCVE-2024-38821Public exploitFix available9.1 Critical
- spring, spring by vmware tanzu framework +1 moreCVE-2024-38816: Path traversal vulnerability in functional web frameworksCVE-2024-38816Public exploitFix availableEPSS 21.3%7.5 High
- spring bootCVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's LoaderCVE-2024-38807Fix available6.3 Medium
- spring framework, vmware spring framework, netapp active iq unified manager +1 more +3 moreCVE-2024-38808: Spring Expression DoS VulnerabilityCVE-2024-38808Fix available4.3 Medium
- spring security, vmware spring security +1 moreMissing Authorization When Using @AuthorizeReturnObjectCVE-2024-38810Fix available6.5 Medium
- spring cloud data flow, vmware spring cloud data flow +1 moreCVE-2024-37084: Remote code execution in Spring Cloud Data FlowCVE-2024-37084Public exploitFix availableEPSS 35.2%9.8 Critical
- spring framework, vmware spring framework +1 moreCVE-2024-22262: Spring Framework URL Parsing with Host ValidationCVE-2024-22262Public exploitFix available8.1 High
- springCVE-2024-22258: PKCE Downgrade in Spring Authorization ServerCVE-2024-22258Fix available6.1 Medium
- pivotal software spring security, spring security +1 moreErroneous authentication pass in Spring SecurityCVE-2024-22257Fix available8.2 High
- spring framework, vmware spring framework, netapp active iq unified manager +2 moreCVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)CVE-2024-22259Fix available8.1 High
- pivotal software spring framework, spring framework, netapp active iq unified manager +2 moreCVE-2024-22243: Spring Framework URL Parsing with Host ValidationCVE-2024-22243Public exploitFix available8.1 High
- spring security, vmware spring security +1 moreCVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticatedCVE-2024-22234Fix available7.4 High
- spring security, vmware spring security +1 moreSpring Security's spring-security.xsd file is world writableCVE-2023-34042Fix available4.1 Medium
- spring cloud contract, vmware spring cloud contract +1 moreSpring Cloud Contract vulnerable to local information disclosureCVE-2024-22236Fix available3.3 Low
- spring framework, vmware spring framework +1 moreCVE-2024-22233: Spring Framework server Web DoS VulnerabilityCVE-2024-22233Fix available7.5 High
- spring boot, vmware spring boot +1 moreSpring Boot server Web Observations DoS VulnerabilityCVE-2023-34055Fix available5.3 Medium
- broadcom reactor nettyReactor Netty HTTP Server Metrics DoS VulnerabilityCVE-2023-34054Fix available5.3 Medium
- spring framework, vmware spring framework +1 moreSpring Framework server Web Observations DoS VulnerabilityCVE-2023-34053Fix available5.3 Medium
- spring amqp, vmware spring advanced message queuing protocol +1 moreSpring AMQP Deserialization VulnerabilityCVE-2023-34050Public exploit5.0 Medium
- spring for graphql, vmware spring for graphql +1 moreExposure of data and identity to wrong session in Spring for GraphQLCVE-2023-34047Fix available3.1 Low
- spring for apache kafka, vmware spring for apache kafka +1 moreJava Deserialization vulnerability in Spring-Kafka When Improperly ConfiguredCVE-2023-34040Public exploitFix available5.3 Medium
- spring security, vmware spring security +1 moreAccess Control Bypass in Spring SecurityCVE-2023-34034Public exploitFix available9.1 Critical
- spring security, vmware spring security +1 moreSpring Security's authorization rules can be misconfigured when using multiple servletsCVE-2023-34035Public exploitFix available7.3 High
- spring hateoas, vmware spring hateoas +1 moreForwarded header exploit with Spring HATEOAS on WebFluxCVE-2023-34036Fix available5.3 Medium
- spring boot, vmware spring boot +1 moreSpring Boot Welcome Page Denial of ServiceCVE-2023-20883Fix available7.5 High
- spring boot, vmware spring boot +1 moreSpring Boot Security Bypass with Wildcard Pattern Matching on Cloud FoundryCVE-2023-20873Fix available9.8 Critical
- spring security, vmware spring security, netapp active iq unified manager +2 moreSpring Security logout not clearing security contextCVE-2023-20862Fix available6.3 Medium
- spring security, vmware spring security, netapp active iq unified manager +2 morespring-security-oauth2-client vulnerable to Privilege EscalationCVE-2022-31690Fix available8.1 High
- spring security, vmware spring security, netapp active iq unified manager +1 more +3 moreInteger overflow in BCrypt class in Spring SecurityCVE-2022-22976Public exploitFix available5.3 Medium
- spring security, vmware spring security, netapp active iq unified manager +1 more +3 moreAuthorization bypass in Spring SecurityCVE-2022-22978Public exploitFix availableEPSS 12.4%9.8 Critical
- Show moreLoading…