Skip to contentSpring vulnerabilities
Newest
- spring framework, vmware spring framework +1 moreSpring Framework Denial of Service via Unbounded Cache in SpELCVE-2026-41851Fix available5.3 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Algorithmic Denial of Service via SpEL ExpressionsCVE-2026-41850Fix available7.5 High
- spring framework, vmware spring framework +1 moreSpring Framework Denial of Service via Integer Overflow in SpEL ExpressionsCVE-2026-41849Fix available7.5 High
- spring framework, vmware spring framework +1 moreSpring Framework Denial of Service via AntPathMatcherCVE-2026-41848Fix available3.7 Low
- spring framework, vmware spring framework +1 moreSpring Framework Security Filter Bypass in WebFlux Kotlin Router DSLCVE-2026-418474.8 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Cross-site Scripting via JSP Form TagsCVE-2026-41846Fix available5.9 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Cross-site Scripting via JavaScriptUtilsCVE-2026-41845Fix available7.1 High
- spring framework, vmware spring framework +1 moreSpring Framework Open Redirect in Spring MVC and WebFluxCVE-2026-41844Fix available4.2 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFluxCVE-2026-41843Fix available5.9 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Denial of Service via Versioned Resources in Spring MVC and WebFluxCVE-2026-41842Fix available7.5 High
- spring framework, vmware spring framework +1 moreSpring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFluxCVE-2026-41841Fix available5.9 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Denial of Service via Multipart Requests in WebFluxCVE-2026-41840Fix available5.9 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Escalation via Session Fixation in WebFluxCVE-2026-41839Fix available4.2 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Predictable Session ID in WebSocket ModuleCVE-2026-41838Fix available4.8 Medium
- spring ldapAuthentication Bypass with Empty Password in Spring LDAPCVE-2026-41720Fix available7.4 High
- spring reactor nettyReactor Netty HTTP Client Leaks Credentials On Protocol Downgrade RedirectCVE-2026-41715Fix available6.1 Medium
- broadcom spring retry, spring retry +1 moreCache Exhaustion in Stateful Retries leads to Denial of ServiceCVE-2026-41710Public exploitFix available5.9 Medium
- spring micrometer, red hat amq broker 7.13.6, amq broker 7.14.1 +19 more +21 moreMicrometer HTTP server instrumentations DoS vulnerabilityCVE-2026-40984Fix available7.5 High
- spring micrometer, red hat amq broker 7.14.1, amq clients +18 more +20 moreMicrometer gRPC server instrumentation DoS vulnerabilityCVE-2026-40983Fix available7.5 High
- spring cloud function, vmware spring cloud function +1 moreUnbounded cache for function definitionsCVE-2026-40990Fix available5.7 Medium
- spring cloud function, vmware spring cloud function +1 moreSelf Routing guard bypassed via function compositionCVE-2026-40989Fix available5.7 Medium
- spring ai, vmware spring ai +1 moreLLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills APICVE-2026-41863Fix available6.5 Medium
- spring ai, vmware spring ai +1 moreSpring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDsCVE-2026-41705Fix available8.6 High
- spring cloud config, vmware spring cloud config, red hat enterprise linux 8 +1 more +3 moreSpring Cloud Config has an Authorization Bypass Through User-Controlled KeyCVE-2026-40981Fix available7.5 High
- spring cloud config, vmware spring cloud config +1 moreSpring Cloud Config Server Susceptible To TOCTOU AttackCVE-2026-41002Fix available7.4 High
- spring cloud config, vmware spring cloud config +1 moreSpring Cloud Config Server Logged Sensitive InformationCVE-2026-41004Fix available4.4 Medium
- spring cloud config, vmware spring cloud config, red hat enterprise linux 8 +1 more +3 moreSpring Cloud Config vulnerable to Path TraversalCVE-2026-40982Public exploitFix available9.1 Critical
- spring grpc, vmware spring grpc +1 moreSpring gRPC AuthenticationException message reflected to remote clientCVE-2026-40969Fix available3.7 Low
- spring grpc, vmware spring grpc +1 moreSpring gRPC SecurityContext leaks across requests on authorization failureCVE-2026-40968Fix available4.3 Medium
- spring ai, vmware spring ai +1 moreSpring AI Vulnerable to OOM by attacker-controlled PDFCVE-2026-40980Fix available6.5 Medium
- spring ai, vmware spring ai +1 moreSpring AI's ONNX model cache defaults to world-writable predictable /tmp directoryCVE-2026-40979Fix available6.1 Medium
- spring ai, vmware spring ai +1 moreSpring AI has SQL Injection in CosmosDBVectorStore.doDelete()CVE-2026-40978Fix available8.8 High
- spring ai, vmware spring ai +1 moreSpring AI has a VectorStore FilterExpression Converter injectionCVE-2026-40967Fix available8.6 High
- spring boot, vmware spring boot +1 moreSpring Boot's PID file write follows symlinks at predictable default pathCVE-2026-40977Fix available4.7 Medium
- spring boot, vmware spring boot, red hat amq broker 7 +14 more +16 moreSpring Boot's default security filter chain has no authorization rule with Actuator but without HealthCVE-2026-40976Fix available9.1 Critical
- spring boot, vmware spring boot, red hat hawtio hawtio 4.4.0 +14 more +16 moreSpring Boot's random value property source uses a weak PRNG unsuitable for secretsCVE-2026-40975Fix available4.8 Medium
- spring boot, vmware spring boot +1 moreSpring Boot's Cassandra SSL auto-configuration disables TLS hostname verificationCVE-2026-40974Fix available5.0 Medium
- spring boot, vmware spring boot +1 moreSpring Boot accepts predictable temp directory without ownership verificationCVE-2026-40973Fix available7.0 High
- spring boot, vmware spring boot +1 moreSpring Boot DevTools remote secret comparison is vulnerable to timing attacksCVE-2026-40972Fix available7.5 High
- spring boot, vmware spring boot +1 moreSpring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ brokerCVE-2026-40971Fix available5.0 Medium
- spring boot, vmware spring boot +1 moreSpring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.CVE-2026-40970Fix available5.0 Medium
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 moreervlet Path Not Correctly Included in Path Matching of XML Authorization RulesCVE-2026-22754Fix available7.5 High
- spring security, vmware spring security +1 moreServlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchersCVE-2026-22753Fix available7.5 High
- spring security, vmware spring security +1 morePotential Security Misconfiguration when Using withIssuerLocationCVE-2026-22748Fix available5.3 Medium
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 moreUnauthorized User Impersonation when Using X.509 Client CertificatesCVE-2026-22747Public exploitFix available6.8 Medium
- spring security, vmware spring security +1 moreUser Attribute Enumeration when Using DaoAuthenticationProviderCVE-2026-22746Fix available3.7 Low
- spring security, vmware spring security +1 moreSpring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessionsCVE-2026-22751Fix available4.8 Medium
- spring ai, vmware spring ai +1 moreSpring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special CharactersCVE-2026-22744Fix available7.5 High
- spring ai, vmware spring ai +1 moreServer-Side Request Forgery via Filter Expression Keys in Neo4jVectorStoreCVE-2026-22743Fix available7.5 High
- spring ai, vmware spring ai +1 moreServer-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL FetchingCVE-2026-22742Fix available8.6 High
- Show moreLoading…